diff --git a/apps/community-mobile/app/auth/otp.tsx b/apps/community-mobile/app/auth/otp.tsx
index 93d5634e..6af0c9ab 100644
--- a/apps/community-mobile/app/auth/otp.tsx
+++ b/apps/community-mobile/app/auth/otp.tsx
@@ -4,6 +4,7 @@ import { useRouter, useLocalSearchParams } from "expo-router"
 import { useSafeAreaInsets } from "react-native-safe-area-context"
 import Ionicons from "@expo/vector-icons/Ionicons"
 import {
+  EMAIL_OTP_CODE_LENGTH,
   REVIEWER_OTP_CODE_MAX_LENGTH,
   REVIEWER_OTP_CODE_MIN_LENGTH,
   REVIEWER_OTP_EMAIL,
@@ -32,10 +33,9 @@ import { useResendCooldown } from "@/hooks/useResendCooldown"
 const { ScrollView: OtpScrollView } = makeKeyboardAwareScrollHost(PLAIN_SCROLL_HOST)
 
 const MAX_ATTEMPTS = 3
-const CODE_LENGTH = 6
 
 function isCodeIncomplete(code: string, reviewer: boolean): boolean {
-  return reviewer ? code.trim().length < REVIEWER_OTP_CODE_MIN_LENGTH : code.length !== CODE_LENGTH
+  return reviewer ? code.trim().length < REVIEWER_OTP_CODE_MIN_LENGTH : code.length !== EMAIL_OTP_CODE_LENGTH
 }
 
 export default function OtpScreen() {
@@ -194,7 +194,7 @@ export default function OtpScreen() {
                   setError(null)
                   setCode(next)
                 }}
-                length={CODE_LENGTH}
+                length={EMAIL_OTP_CODE_LENGTH}
                 onComplete={onVerify}
                 editable={!locked && !verifying}
               />
diff --git a/apps/community-mobile/src/components/FirstRunGate.tsx b/apps/community-mobile/src/components/FirstRunGate.tsx
index 27a3dd4e..11063960 100644
--- a/apps/community-mobile/src/components/FirstRunGate.tsx
+++ b/apps/community-mobile/src/components/FirstRunGate.tsx
@@ -2,6 +2,7 @@ import React, { useCallback, useEffect, useMemo, useState } from "react"
 import { View, StyleSheet, ActivityIndicator, Pressable } from "react-native"
 import { useSafeAreaInsets } from "react-native-safe-area-context"
 import Ionicons from "@expo/vector-icons/Ionicons"
+import { HANDLE_MAX_LENGTH } from "@civfix/shared"
 import { MIN_TOUCH_TARGET, makeThemedStyles, space, useTheme } from "@/theme"
 import {
   AgeConfirmation,
@@ -32,9 +33,6 @@ import { friendlyError } from "@/lib/errors"
 
 const { ScrollView: FirstRunScrollView } = makeKeyboardAwareScrollHost(PLAIN_SCROLL_HOST)
 
-// The upper bound of the shared HANDLE_REGEX, so the field stops where validation would reject.
-const HANDLE_MAX_LENGTH = 20
-
 export function FirstRunGate() {
   const status = useAuthStore((s) => s.status)
   const incomplete = useAuthStore((s) => s.user?.profileComplete === false)
diff --git a/apps/community-mobile/src/lib/authResume.ts b/apps/community-mobile/src/lib/authResume.ts
index c50ab031..4c700f30 100644
--- a/apps/community-mobile/src/lib/authResume.ts
+++ b/apps/community-mobile/src/lib/authResume.ts
@@ -1,3 +1,5 @@
+import { stripTrailingSlashes } from "@civfix/shared"
+
 const ROOT_ROUTE = "/"
 
 function routeQuery(params: unknown): string {
@@ -27,7 +29,7 @@ export function resumePathname(href: string): string {
   const cut = href.search(/[?#]/)
   const path = cut === -1 ? href : href.slice(0, cut)
   if (path.length > 1 && path.endsWith("/")) {
-    const trimmed = path.replace(/\/+$/, "")
+    const trimmed = stripTrailingSlashes(path)
     return trimmed.length > 0 ? trimmed : "/"
   }
   return path
diff --git a/apps/community-web/src/components/auth/auth-modal.tsx b/apps/community-web/src/components/auth/auth-modal.tsx
index 60da180e..5eb67347 100644
--- a/apps/community-web/src/components/auth/auth-modal.tsx
+++ b/apps/community-web/src/components/auth/auth-modal.tsx
@@ -4,6 +4,7 @@ import * as React from "react"
 import { createPortal } from "react-dom"
 import { X } from "lucide-react"
 
+import { EMAIL_OTP_CODE_LENGTH } from "@civfix/shared"
 import { useT } from "@civfix/ui/i18n"
 
 import { useFocusTrap } from "@/components/console/overlay/use-focus-trap"
@@ -18,8 +19,6 @@ import { useUiStore } from "@/store/ui-store"
 import { AuthStepHeading, ChoicesStep, CodeStep, EmailStep, type AuthStep } from "./auth-modal-steps"
 import { useOtpEntry } from "./use-otp-entry"
 
-const OTP_LENGTH = 6
-
 /**
  * The return target is the current origin, or a same-origin console path allowlisted by oauthReturnPath
  * (such as an org invite waiting to be accepted). Apple is offered only when the server has a Sign in
@@ -51,7 +50,7 @@ export function AuthModal({ oauthReturnPath = null }: AuthModalProps = {}) {
 
   const [step, setStep] = React.useState<AuthStep>("choices")
   const [email, setEmail] = React.useState("")
-  const otp = useOtpEntry(OTP_LENGTH)
+  const otp = useOtpEntry(EMAIL_OTP_CODE_LENGTH)
   const [submitting, setSubmitting] = React.useState(false)
   const [error, setError] = React.useState<string | null>(null)
   const [resendAfter, setResendAfter] = React.useState<number>(0)
@@ -222,7 +221,7 @@ export function AuthModal({ oauthReturnPath = null }: AuthModalProps = {}) {
             <CodeStep
               t={t}
               otp={otp}
-              length={OTP_LENGTH}
+              length={EMAIL_OTP_CODE_LENGTH}
               submitting={submitting}
               error={error}
               resendAfter={resendAfter}
diff --git a/apps/community-web/src/components/dev/bodies-gallery.tsx b/apps/community-web/src/components/dev/bodies-gallery.tsx
index b8d91807..f645066a 100644
--- a/apps/community-web/src/components/dev/bodies-gallery.tsx
+++ b/apps/community-web/src/components/dev/bodies-gallery.tsx
@@ -21,6 +21,7 @@ import type {
   PostDTO,
 } from "@civfix/shared"
 import type { CleanupAttendeesResponse } from "@civfix/shared"
+import { MS_PER_DAY, MS_PER_MINUTE } from "@civfix/shared"
 import type {
   EventHoursResponse,
   EventSlotDTO,
@@ -79,14 +80,12 @@ import {
   portfolioOverrides,
 } from "./dashboard-fixtures"
 import {
-  DAY_MS,
   GALLERY_LEADERBOARD_PODIUM,
   GALLERY_MY_PROFILE,
   GALLERY_NOTIFICATIONS,
   GALLERY_NOTIFICATION_PREFS,
   GALLERY_SEARCH_RESULTS,
   GALLERY_VIEWER,
-  MINUTE_MS,
   daysAgo,
   galleryChatHistory,
   galleryThreads,
@@ -108,7 +107,7 @@ const ORGANIZER = {
 }
 
 function event(id: string, title: string, daysAgo: number, organizerId: string): CleanupDTO {
-  const scheduledAt = isoFromNow(-daysAgo * DAY_MS)
+  const scheduledAt = isoFromNow(-daysAgo * MS_PER_DAY)
   return {
     id,
     title,
@@ -166,7 +165,7 @@ const LINKED_EVENTS = [
     id: "e1",
     title: "Creekside litter sweep",
     eventKind: "cleanup",
-    scheduledAt: isoFromNow(2 * DAY_MS),
+    scheduledAt: isoFromNow(2 * MS_PER_DAY),
     lat: 37.77,
     lng: -122.42,
     going: 8,
@@ -264,7 +263,7 @@ const NEARBY_CLEANUPS: { items: CleanupDTO[]; nextCursor: string | null } = {
   items: [
     {
       ...event("e1", "Creekside litter sweep", -2, "p-ann"),
-      scheduledAt: isoFromNow(2 * DAY_MS),
+      scheduledAt: isoFromNow(2 * MS_PER_DAY),
       status: "upcoming",
       joined: true,
       going: 8,
@@ -273,7 +272,7 @@ const NEARBY_CLEANUPS: { items: CleanupDTO[]; nextCursor: string | null } = {
     {
       ...event("e2", "Mission mural touch-up", -2, "p-lee"),
       organizer: { ...ORGANIZER, id: "p-lee", name: "Lee Tran", handle: "leetran" },
-      scheduledAt: isoFromNow(5 * DAY_MS),
+      scheduledAt: isoFromNow(5 * MS_PER_DAY),
       status: "upcoming",
       joined: false,
       going: 14,
@@ -282,7 +281,7 @@ const NEARBY_CLEANUPS: { items: CleanupDTO[]; nextCursor: string | null } = {
     {
       ...event("e5", "Dolores Park planting", -2, "p-mei"),
       organizer: { ...ORGANIZER, id: "p-mei", name: "Mei Wong", handle: "meiwong" },
-      scheduledAt: isoFromNow(6 * DAY_MS),
+      scheduledAt: isoFromNow(6 * MS_PER_DAY),
       status: "upcoming",
       joined: false,
       going: 5,
@@ -290,7 +289,7 @@ const NEARBY_CLEANUPS: { items: CleanupDTO[]; nextCursor: string | null } = {
     },
     {
       ...event("e6", "Bayview shoreline sweep", -2, "p-ann"),
-      scheduledAt: isoFromNow(8 * DAY_MS),
+      scheduledAt: isoFromNow(8 * MS_PER_DAY),
       status: "upcoming",
       joined: false,
       going: 21,
@@ -322,7 +321,7 @@ const FEED_POSTS: PostDTO[] = [
     author: ORGANIZER,
     kind: "post",
     body: "We are meeting by the east gate Saturday morning. Come help us reset the creek path before summer.",
-    createdAt: isoFromNow(-35 * MINUTE_MS),
+    createdAt: isoFromNow(-35 * MS_PER_MINUTE),
     event: {
       id: "e1",
       title: "Creekside litter sweep",
@@ -333,7 +332,7 @@ const FEED_POSTS: PostDTO[] = [
       lng: NEARBY_CLEANUPS.items[0]!.lng,
       going: 8,
       organizer: ORGANIZER,
-      linkedAt: isoFromNow(-35 * MINUTE_MS),
+      linkedAt: isoFromNow(-35 * MS_PER_MINUTE),
     },
     report: null,
     repostOf: null,
@@ -412,7 +411,7 @@ const CLEANUP_DETAIL: CleanupDTO = {
   eventKind: "cleanup",
   description:
     "Join us for a morning sweep along the creek path. We will tackle the litter that washed up after the rain, then grab coffee. Newcomers welcome - tools provided if you do not have your own.",
-  scheduledAt: isoFromNow(2 * DAY_MS),
+  scheduledAt: isoFromNow(2 * MS_PER_DAY),
   status: "upcoming",
   joined: false,
   going: 8,
@@ -440,7 +439,7 @@ const EDIT_CLEANUP_DETAIL: CleanupDTO = {
   ...event("e-mine", "24th St planter day", -3, "me"),
   eventKind: "cleanup",
   description: "We are refreshing the sidewalk planters along 24th St. Tools and soil provided.",
-  scheduledAt: isoFromNow(6 * DAY_MS),
+  scheduledAt: isoFromNow(6 * MS_PER_DAY),
   status: "upcoming",
   joined: false,
   going: 5,
diff --git a/apps/community-web/src/components/dev/dashboard-fixtures.ts b/apps/community-web/src/components/dev/dashboard-fixtures.ts
index ed299d92..6d7f64ee 100644
--- a/apps/community-web/src/components/dev/dashboard-fixtures.ts
+++ b/apps/community-web/src/components/dev/dashboard-fixtures.ts
@@ -4,7 +4,7 @@ import {
   fakeHostedEvents,
   fakeHostedEventsAnalytics,
 } from "@civfix/shared/fakes"
-import { MAX_PORTFOLIO_TOP_VOLUNTEERS } from "@civfix/shared"
+import { MAX_PORTFOLIO_TOP_VOLUNTEERS, MS_PER_DAY, MS_PER_HOUR, MS_PER_MINUTE } from "@civfix/shared"
 import type {
   CleanupDTO,
   EventCheckinCountersDTO,
@@ -26,7 +26,7 @@ import type {
   PortfolioAnalyticsRange,
 } from "@civfix/shared"
 
-import { DAY_MS, HOUR_MS, MINUTE_MS, makeCannedApi, type FakeEndpoint } from "./fixtures"
+import { makeCannedApi, type FakeEndpoint } from "./fixtures"
 
 const FIXTURE_NOW = Date.now()
 
@@ -114,8 +114,8 @@ const DASHBOARD_ORGS: readonly OrganizationDTO[] = [
     socialLinks: null,
     verifiedStatus: "verified",
     verifiedKind: "nonprofit",
-    verifiedAt: new Date(FIXTURE_NOW - 240 * DAY_MS).toISOString(),
-    createdAt: new Date(FIXTURE_NOW - 500 * DAY_MS).toISOString(),
+    verifiedAt: new Date(FIXTURE_NOW - 240 * MS_PER_DAY).toISOString(),
+    createdAt: new Date(FIXTURE_NOW - 500 * MS_PER_DAY).toISOString(),
     memberCount: 24,
     eventCount: 31,
     myRole: "owner",
@@ -134,7 +134,7 @@ const DASHBOARD_ORGS: readonly OrganizationDTO[] = [
     verifiedStatus: "unverified",
     verifiedKind: null,
     verifiedAt: null,
-    createdAt: new Date(FIXTURE_NOW - 180 * DAY_MS).toISOString(),
+    createdAt: new Date(FIXTURE_NOW - 180 * MS_PER_DAY).toISOString(),
     memberCount: 9,
     eventCount: 6,
     myRole: "admin",
@@ -151,15 +151,15 @@ const EVENT_INVITES: ListMyEventInvitesResponse = {
       event: {
         id: "ev-invite-1",
         title: "Creekside trail restoration",
-        startsAt: new Date(FIXTURE_NOW + 6 * DAY_MS).toISOString(),
-        endsAt: new Date(FIXTURE_NOW + 6 * DAY_MS + 4 * HOUR_MS).toISOString(),
+        startsAt: new Date(FIXTURE_NOW + 6 * MS_PER_DAY).toISOString(),
+        endsAt: new Date(FIXTURE_NOW + 6 * MS_PER_DAY + 4 * MS_PER_HOUR).toISOString(),
         status: "upcoming",
         coverThumbUrl: null,
         address: "Glen Canyon Park, San Francisco",
       },
       invitedBy: COHOST,
-      createdAt: new Date(FIXTURE_NOW - 2 * DAY_MS).toISOString(),
-      expiresAt: new Date(FIXTURE_NOW + 12 * DAY_MS).toISOString(),
+      createdAt: new Date(FIXTURE_NOW - 2 * MS_PER_DAY).toISOString(),
+      expiresAt: new Date(FIXTURE_NOW + 12 * MS_PER_DAY).toISOString(),
     },
   ],
   nextCursor: null,
@@ -179,20 +179,20 @@ const ORG_INVITES: ListMyOrgInvitesResponse = {
       },
       role: "admin",
       invitedBy: COHOST,
-      createdAt: new Date(FIXTURE_NOW - 4 * DAY_MS).toISOString(),
-      expiresAt: new Date(FIXTURE_NOW + 10 * DAY_MS).toISOString(),
+      createdAt: new Date(FIXTURE_NOW - 4 * MS_PER_DAY).toISOString(),
+      expiresAt: new Date(FIXTURE_NOW + 10 * MS_PER_DAY).toISOString(),
     },
   ],
 }
 
 const ORG_MEMBERS: ListOrganizationMembersResponse = {
   items: [
-    { person: HOST, role: "owner", joinedAt: new Date(FIXTURE_NOW - 500 * DAY_MS).toISOString(), canRemove: false },
-    { person: COHOST, role: "admin", joinedAt: new Date(FIXTURE_NOW - 300 * DAY_MS).toISOString(), canRemove: true },
+    { person: HOST, role: "owner", joinedAt: new Date(FIXTURE_NOW - 500 * MS_PER_DAY).toISOString(), canRemove: false },
+    { person: COHOST, role: "admin", joinedAt: new Date(FIXTURE_NOW - 300 * MS_PER_DAY).toISOString(), canRemove: true },
     {
       person: person("p-lee", "Lee Tran", "leetran"),
       role: "member",
-      joinedAt: new Date(FIXTURE_NOW - 90 * DAY_MS).toISOString(),
+      joinedAt: new Date(FIXTURE_NOW - 90 * MS_PER_DAY).toISOString(),
       canRemove: true,
     },
   ],
@@ -209,8 +209,8 @@ const ORG_INVITE_LIST: ListOrganizationInvitesResponse = {
       role: "member",
       status: "pending",
       invitedBy: HOST,
-      createdAt: new Date(FIXTURE_NOW - 3 * DAY_MS).toISOString(),
-      expiresAt: new Date(FIXTURE_NOW + 11 * DAY_MS).toISOString(),
+      createdAt: new Date(FIXTURE_NOW - 3 * MS_PER_DAY).toISOString(),
+      expiresAt: new Date(FIXTURE_NOW + 11 * MS_PER_DAY).toISOString(),
     },
   ],
 }
@@ -239,8 +239,8 @@ const EXTRA_TOP_VOLUNTEERS: readonly LeaderboardEntryDTO[] = [
 const NEEDS_HOURS_EVENT: HostedEventDTO = {
   id: "ev-needs-hours",
   title: "Islais Creek weed pull",
-  startsAt: new Date(FIXTURE_NOW - 2 * DAY_MS).toISOString(),
-  endsAt: new Date(FIXTURE_NOW - 2 * DAY_MS + 3 * HOUR_MS).toISOString(),
+  startsAt: new Date(FIXTURE_NOW - 2 * MS_PER_DAY).toISOString(),
+  endsAt: new Date(FIXTURE_NOW - 2 * MS_PER_DAY + 3 * MS_PER_HOUR).toISOString(),
   timezone: "America/Los_Angeles",
   status: "upcoming",
   visibility: "public",
@@ -368,7 +368,7 @@ function phaseCounters(id: string, phase: EventPhase): EventCheckinCountersDTO {
       capacity: row.capacity,
     })),
     arrivals: insights.arrivals.map((bucket) => ({
-      at: new Date(startsAt + bucket.offsetMin * MINUTE_MS).toISOString(),
+      at: new Date(startsAt + bucket.offsetMin * MS_PER_MINUTE).toISOString(),
       count: bucket.seats,
     })),
     asOf: new Date().toISOString(),
@@ -407,18 +407,18 @@ function phaseRoster(id: string, phase: EventPhase): ListEventRegistrationsRespo
         attendeeName: seatIndex === 0 ? who.name : null,
         status: "active" as const,
         ticketToken: null,
-        checkedInAt: checkedIn ? new Date(startsAt + i * 6 * MINUTE_MS).toISOString() : null,
+        checkedInAt: checkedIn ? new Date(startsAt + i * 6 * MS_PER_MINUTE).toISOString() : null,
         checkinMethod: checkedIn ? ("scan" as const) : null,
         noShowAt: null,
       })),
       status: i === ROSTER_PEOPLE.length - 1 ? "cancelled" : "registered",
       source: i === 3 ? "walkup" : "self",
-      registeredAt: new Date(startsAt - (14 - i) * DAY_MS).toISOString(),
+      registeredAt: new Date(startsAt - (14 - i) * MS_PER_DAY).toISOString(),
       cancelledAt:
         i === ROSTER_PEOPLE.length - 1
-          ? new Date(startsAt - 2 * DAY_MS).toISOString()
+          ? new Date(startsAt - 2 * MS_PER_DAY).toISOString()
           : null,
-      checkedInAt: checkedIn ? new Date(startsAt + i * 6 * MINUTE_MS).toISOString() : null,
+      checkedInAt: checkedIn ? new Date(startsAt + i * 6 * MS_PER_MINUTE).toISOString() : null,
       checkedInBy: checkedIn ? HOST : null,
       slot: null,
       waitlistPosition: null,
diff --git a/apps/community-web/src/components/dev/fixtures.ts b/apps/community-web/src/components/dev/fixtures.ts
index 7c00a582..d68c9d4b 100644
--- a/apps/community-web/src/components/dev/fixtures.ts
+++ b/apps/community-web/src/components/dev/fixtures.ts
@@ -11,14 +11,11 @@ import type {
   UserDTO,
   UserProfileDTO,
 } from "@civfix/shared"
-
-export const MINUTE_MS = 60_000
-export const HOUR_MS = 60 * MINUTE_MS
-export const DAY_MS = 24 * HOUR_MS
+import { MS_PER_DAY, MS_PER_HOUR, MS_PER_MINUTE } from "@civfix/shared"
 
 export const isoFromNow = (ms: number): string => new Date(Date.now() + ms).toISOString()
-export const hoursAgo = (h: number): string => isoFromNow(-h * HOUR_MS)
-export const daysAgo = (d: number): string => isoFromNow(-d * DAY_MS)
+export const hoursAgo = (h: number): string => isoFromNow(-h * MS_PER_HOUR)
+export const daysAgo = (d: number): string => isoFromNow(-d * MS_PER_DAY)
 
 export const GALLERY_VIEWER = {
   id: "me",
@@ -139,7 +136,7 @@ function chatMessage(
     },
     body,
     kind: "text",
-    createdAt: isoFromNow(-minsAgo * MINUTE_MS),
+    createdAt: isoFromNow(-minsAgo * MS_PER_MINUTE),
   } as ChatMessageDTO
 }
 
diff --git a/apps/community-web/src/components/dev/landscape-fake-api.ts b/apps/community-web/src/components/dev/landscape-fake-api.ts
index bc2b82e3..f8240c67 100644
--- a/apps/community-web/src/components/dev/landscape-fake-api.ts
+++ b/apps/community-web/src/components/dev/landscape-fake-api.ts
@@ -15,10 +15,10 @@ import type {
   ReportDTO,
   UserProfileDTO,
 } from "@civfix/shared"
+import { MS_PER_DAY } from "@civfix/shared"
 import { makeFakeApiClient } from "@civfix/ui/data"
 
 import {
-  DAY_MS,
   GALLERY_LEADERBOARD_PODIUM,
   GALLERY_MY_PROFILE,
   GALLERY_NOTIFICATIONS,
@@ -77,7 +77,7 @@ function cleanup(
     description: "Gloves, bags and grabbers provided. Meet at the gate; we finish by noon.",
     lat: 37.77,
     lng: -122.42,
-    scheduledAt: isoFromNow(inDays * DAY_MS),
+    scheduledAt: isoFromNow(inDays * MS_PER_DAY),
     status: "upcoming",
     organizer,
     going: 12,
diff --git a/apps/community-web/src/features/auth/first-run-gate.tsx b/apps/community-web/src/features/auth/first-run-gate.tsx
index bc535cda..9677c727 100644
--- a/apps/community-web/src/features/auth/first-run-gate.tsx
+++ b/apps/community-web/src/features/auth/first-run-gate.tsx
@@ -2,6 +2,7 @@
 
 import * as React from "react"
 import { Loader2, Check, X } from "lucide-react"
+import { HANDLE_MAX_LENGTH } from "@civfix/shared"
 import { space } from "@civfix/shared/tokens"
 
 import { Avatar, AgeConfirmation, TermsConfirmation } from "@civfix/ui"
@@ -20,7 +21,6 @@ import { useCurrentUser, useLogout } from "@/hooks/use-auth"
 import { useVisualViewportShift } from "@/hooks/use-visual-viewport-shift"
 import { useFirstRunRequired } from "@/hooks/use-profile-registration"
 import { errorMessage } from "@/lib/error-messages"
-import { HANDLE_MAX_LENGTH } from "@/lib/input-limits"
 import { SESSION_ALERT_ATTR, Z_FIRST_RUN_GATE } from "@/styles/z-layers"
 
 export function FirstRunGate() {
diff --git a/apps/community-web/src/features/host/broadcasts/broadcast-composer.tsx b/apps/community-web/src/features/host/broadcasts/broadcast-composer.tsx
index cae7b470..92a77170 100644
--- a/apps/community-web/src/features/host/broadcasts/broadcast-composer.tsx
+++ b/apps/community-web/src/features/host/broadcasts/broadcast-composer.tsx
@@ -5,6 +5,7 @@ import { Eye, Send, Clock, TestTube } from "lucide-react"
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
 import type { BroadcastDTO, BroadcastPreviewDTO, BroadcastSegment } from "@civfix/shared"
 import {
+  HTTPS_URL_MAX_LENGTH,
   MAX_BROADCAST_BODY,
   MAX_BROADCAST_CTA_LABEL,
   MAX_BROADCAST_SUBJECT,
@@ -14,7 +15,6 @@ import { useApi, useAuthState, useEventTicketTypes } from "@civfix/ui/data"
 import { useT } from "@civfix/ui/i18n"
 import type { Translate } from "@civfix/ui/i18n"
 
-import { HTTPS_URL_MAX_LENGTH } from "@/lib/input-limits"
 import { fieldErrorsFrom } from "@/components/console/query-state"
 import { ConsoleButton } from "@/components/console/button"
 import { Chip } from "@/components/console/chips/chip"
diff --git a/apps/community-web/src/features/host/org/org-invites.ts b/apps/community-web/src/features/host/org/org-invites.ts
index e326d086..d0c04150 100644
--- a/apps/community-web/src/features/host/org/org-invites.ts
+++ b/apps/community-web/src/features/host/org/org-invites.ts
@@ -1,8 +1,7 @@
-import type { OrganizationInviteDTO } from "@civfix/shared"
+import { EMAIL_MAX_LENGTH, MS_PER_DAY, type OrganizationInviteDTO } from "@civfix/shared"
 
 import { notifyConsoleUrlChanged } from "@/components/console/url-state"
 import { safeGet, safeRemove, safeSet } from "@/lib/browser-storage"
-import { EMAIL_MAX_LENGTH } from "@/lib/input-limits"
 import { replaceUrlInPlace } from "@/lib/replace-url"
 
 /**
@@ -20,8 +19,6 @@ export const INVITE_IDENTIFIER_MAX = EMAIL_MAX_LENGTH
 /** The backend's `ORG_INVITE_TTL_MS` (14 days) - the copy says it before an invite exists. */
 export const ORG_INVITE_TTL_DAYS = 14
 
-const DAY_MS = 24 * 60 * 60 * 1000
-
 /**
  * Whole days until `iso`, rounded up so "expires in 1 day" reads until the moment it expires and
  * never says "0 days" for a still-valid invite. Zero or negative means it has already expired.
@@ -29,7 +26,7 @@ const DAY_MS = 24 * 60 * 60 * 1000
 export function daysUntil(iso: string, now: number = Date.now()): number {
   const at = new Date(iso).getTime()
   if (Number.isNaN(at)) return 0
-  return Math.ceil((at - now) / DAY_MS)
+  return Math.ceil((at - now) / MS_PER_DAY)
 }
 
 /**
diff --git a/apps/community-web/src/features/host/org/org-profile-form.tsx b/apps/community-web/src/features/host/org/org-profile-form.tsx
index 9bf51997..d75a2e9b 100644
--- a/apps/community-web/src/features/host/org/org-profile-form.tsx
+++ b/apps/community-web/src/features/host/org/org-profile-form.tsx
@@ -8,21 +8,24 @@ import type { OrganizationDTO, SocialLinks, SocialPlatform } from "@civfix/share
 import {
   CreateOrganizationRequestSchema,
   ErrorCode,
+  HTTPS_URL_MAX_LENGTH,
   MAX_ORG_DESCRIPTION,
   MAX_ORG_NAME,
   ORG_SLUG_MAX,
   ORG_SLUG_MIN,
   SafeHttpsLinkSchema,
+  SOCIAL_HANDLE_MAX_LENGTH,
+  SOCIAL_HANDLE_PREFIX,
   SOCIAL_PLATFORMS,
   SOCIAL_PLATFORM_LABELS,
   UpdateOrganizationRequestSchema,
+  WHATSAPP_NUMBER_MAX_LENGTH,
   toAppError,
 } from "@civfix/shared"
 import { useApi, useAuthState } from "@civfix/ui/data"
 import { useT } from "@civfix/ui/i18n"
 
 import { cn } from "@/lib/utils"
-import { HTTPS_URL_MAX_LENGTH } from "@/lib/input-limits"
 import { ConsoleButton } from "@/components/console/button"
 import { Field } from "@/components/console/forms/field"
 import { CONSOLE_INPUT_CLASSES, TextInput, TextArea } from "@/components/console/forms/inputs"
@@ -49,25 +52,11 @@ import type { OrgSlugProblem } from "./org-slug"
 import { suspendedForbiddenCopy } from "./org-copy"
 import type { Translate } from "@civfix/ui/i18n"
 
-/** Mirrors the contract's social handle pattern (`{1,30}`). */
-const SOCIAL_HANDLE_MAX = 30
-/** An E.164 number is at most 15 digits. */
-const WHATSAPP_NUMBER_MAX = 15
-
 const SECTION_CLASSES =
   "rounded-md border border-console-line bg-console-surface p-token-4 shadow-console-1"
 const PREFIX_BOX_CLASSES =
   "inline-flex items-center rounded-l-xs border border-r-0 border-console-line bg-console-surface-alt"
 
-/** What each social field is prefixed with so the host types only the handle. */
-const SOCIAL_PREFIX: Record<SocialPlatform, string> = {
-  facebook: "facebook.com/",
-  instagram: "instagram.com/",
-  tiktok: "tiktok.com/@",
-  x: "x.com/",
-  whatsapp: "+",
-}
-
 export interface OrgProfileDraft {
   name: string
   slug: string
@@ -730,7 +719,7 @@ function SocialLinkField({
       optional
       error={error}
     >
-      <InputPrefix prefix={SOCIAL_PREFIX[platform]} compact>
+      <InputPrefix prefix={SOCIAL_HANDLE_PREFIX[platform]} compact>
         <input
           id={id}
           value={value}
@@ -738,7 +727,7 @@ function SocialLinkField({
           autoCapitalize="none"
           spellCheck={false}
           inputMode={whatsapp ? "tel" : "text"}
-          maxLength={whatsapp ? WHATSAPP_NUMBER_MAX : SOCIAL_HANDLE_MAX}
+          maxLength={whatsapp ? WHATSAPP_NUMBER_MAX_LENGTH : SOCIAL_HANDLE_MAX_LENGTH}
           aria-invalid={error ? true : undefined}
           className={cn(CONSOLE_INPUT_CLASSES, "rounded-l-none", error && "border-console-bloom-strong")}
           onChange={(event) => onChange(event.target.value)}
diff --git a/apps/community-web/src/features/host/org/verification-screen.tsx b/apps/community-web/src/features/host/org/verification-screen.tsx
index 8c0ce61d..ea5bc77b 100644
--- a/apps/community-web/src/features/host/org/verification-screen.tsx
+++ b/apps/community-web/src/features/host/org/verification-screen.tsx
@@ -12,6 +12,7 @@ import type {
 import {
   ApplyOrganizationVerificationRequestSchema,
   MAX_ORG_VERIFICATION_DOCUMENTS,
+  MAX_ORG_VERIFICATION_NOTE,
 } from "@civfix/shared"
 import { useApi } from "@civfix/ui/data"
 import { useT } from "@civfix/ui/i18n"
@@ -40,8 +41,6 @@ import { suspendedForbiddenCopy } from "./org-copy"
 import { useOrgVerification } from "./use-org-verification"
 
 const KINDS: readonly OrgVerificationKind[] = ["nonprofit", "government", "community"]
-/** Mirrors the contract's unexported `note` max on the apply request. */
-const MAX_NOTE = 1000
 /** "XX-XXXXXXX", the shape `normalizeEin` types into the field. */
 const EIN_INPUT_MAX = 10
 
@@ -350,13 +349,13 @@ function ApplyForm({ orgId, onSubmitted }: { orgId: string; onSubmitted: () => v
             label={t("verification.field_note", { defaultValue: "Note for the reviewer" })}
             htmlFor="verification-note"
             optional
-            counter={`${note.length}/${MAX_NOTE}`}
+            counter={`${note.length}/${MAX_ORG_VERIFICATION_NOTE}`}
             error={showError("note")}
           >
             <TextArea
               id="verification-note"
               rows={4}
-              maxLength={MAX_NOTE}
+              maxLength={MAX_ORG_VERIFICATION_NOTE}
               value={note}
               placeholder={t("verification.note_placeholder", {
                 defaultValue: "Anything that helps us match the documents to this organization.",
diff --git a/apps/community-web/src/features/host/page-builder/block-editor.tsx b/apps/community-web/src/features/host/page-builder/block-editor.tsx
index 8f124123..3d0e9a2b 100644
--- a/apps/community-web/src/features/host/page-builder/block-editor.tsx
+++ b/apps/community-web/src/features/host/page-builder/block-editor.tsx
@@ -3,11 +3,10 @@
 import type { ComponentType, ReactNode } from "react"
 import { Plus, Trash2 } from "lucide-react"
 import type { EventPageBlock, EventPageBlockKind } from "@civfix/shared"
-import { SAFE_HTTPS_LINK_MAX } from "@civfix/shared"
+import { EMAIL_MAX_LENGTH, EVENT_PAGE_BLOCK_LIMITS, SAFE_HTTPS_LINK_MAX } from "@civfix/shared"
 import { MARKDOWN_SUBSET_MAX_CHARS } from "@civfix/shared/markdown"
 import { useT } from "@civfix/ui/i18n"
 
-import { EMAIL_MAX_LENGTH } from "@/lib/input-limits"
 import { Field } from "@/components/console/forms/field"
 import { TextInput, TextArea } from "@/components/console/forms/inputs"
 import { ToggleRow } from "@/components/console/forms/toggle-row"
@@ -17,23 +16,6 @@ import { ConsoleButton, ConsoleIconButton } from "@/components/console/button"
 import { rowKey, withRowKey } from "./blocks"
 import type { BlockIssue } from "./blocks"
 
-// The block schema's maxima (EventPageBlockSchema in the shared contract), which the contract does
-// not export as constants.
-const BLOCK_TITLE_MAX = 160
-const HERO_HEADLINE_MAX = 160
-const HERO_SUBHEAD_MAX = 320
-const BLOCK_TEXT_MAX = 1200
-const AGENDA_ITEMS_MAX = 30
-const AGENDA_TIME_MAX = 40
-const AGENDA_ITEM_TITLE_MAX = 160
-const ROW_DESCRIPTION_MAX = 600
-const HOST_ENTRIES_MAX = 20
-const ENTRY_NAME_MAX = 120
-const HOST_ROLE_MAX = 80
-const FAQ_ITEMS_MAX = 30
-const FAQ_QUESTION_MAX = 200
-const SPONSOR_ENTRIES_MAX = 20
-
 const LINK_PLACEHOLDER = "https://"
 
 type BlockOf<K extends EventPageBlockKind> = Extract<EventPageBlock, { kind: K }>
@@ -121,7 +103,7 @@ function BlockTitleField({
       label={t("block.title")}
       optional
       value={block.title}
-      maxLength={BLOCK_TITLE_MAX}
+      maxLength={EVENT_PAGE_BLOCK_LIMITS.title}
       onChange={(title) => onChange({ title })}
     />
   )
@@ -249,7 +231,7 @@ function HeroEditor({ block, onChange }: KindEditorProps<"hero">) {
         label={t("block.hero.headline")}
         optional
         value={block.headline}
-        maxLength={HERO_HEADLINE_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.heroHeadline}
         onChange={(headline) => onChange({ headline })}
       />
       <BlockTextField
@@ -257,7 +239,7 @@ function HeroEditor({ block, onChange }: KindEditorProps<"hero">) {
         label={t("block.hero.subhead")}
         optional
         value={block.subhead}
-        maxLength={HERO_SUBHEAD_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.heroSubhead}
         onChange={(subhead) => onChange({ subhead })}
       />
     </BlockFields>
@@ -298,18 +280,22 @@ function AgendaEditor({ block, onChange, errorAt }: KindEditorProps<"agenda">) {
             key: "time",
             label: t("block.agenda.time"),
             optional: true,
-            maxLength: AGENDA_TIME_MAX,
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.agendaTime,
+          },
+          {
+            key: "title",
+            label: t("block.agenda.item_title"),
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.agendaItemTitle,
           },
-          { key: "title", label: t("block.agenda.item_title"), maxLength: AGENDA_ITEM_TITLE_MAX },
           {
             key: "description",
             label: t("block.agenda.item_description"),
             optional: true,
             multiline: true,
-            maxLength: ROW_DESCRIPTION_MAX,
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.rowDescription,
           },
         ]}
-        max={AGENDA_ITEMS_MAX}
+        max={EVENT_PAGE_BLOCK_LIMITS.agendaItems}
         blank={BLANK_AGENDA_ITEM}
         addLabel={t("block.agenda.add")}
       />
@@ -330,17 +316,22 @@ function HostsEditor({ block, onChange, errorAt }: KindEditorProps<"hosts">) {
         errorAt={errorAt}
         rowLabel={(n) => t("block.hosts.entry", { n })}
         fields={[
-          { key: "name", label: t("block.hosts.name"), maxLength: ENTRY_NAME_MAX },
-          { key: "role", label: t("block.hosts.role"), optional: true, maxLength: HOST_ROLE_MAX },
+          { key: "name", label: t("block.hosts.name"), maxLength: EVENT_PAGE_BLOCK_LIMITS.entryName },
+          {
+            key: "role",
+            label: t("block.hosts.role"),
+            optional: true,
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.hostRole,
+          },
           {
             key: "bio",
             label: t("block.hosts.bio"),
             optional: true,
             multiline: true,
-            maxLength: ROW_DESCRIPTION_MAX,
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.rowDescription,
           },
         ]}
-        max={HOST_ENTRIES_MAX}
+        max={EVENT_PAGE_BLOCK_LIMITS.hostEntries}
         blank={BLANK_HOST_ENTRY}
         addLabel={t("block.hosts.add")}
       />
@@ -361,15 +352,15 @@ function FaqEditor({ block, onChange, errorAt }: KindEditorProps<"faq">) {
         errorAt={errorAt}
         rowLabel={(n) => t("block.faq.item", { n })}
         fields={[
-          { key: "question", label: t("block.faq.question"), maxLength: FAQ_QUESTION_MAX },
+          { key: "question", label: t("block.faq.question"), maxLength: EVENT_PAGE_BLOCK_LIMITS.faqQuestion },
           {
             key: "answer",
             label: t("block.faq.answer"),
             multiline: true,
-            maxLength: BLOCK_TEXT_MAX,
+            maxLength: EVENT_PAGE_BLOCK_LIMITS.text,
           },
         ]}
-        max={FAQ_ITEMS_MAX}
+        max={EVENT_PAGE_BLOCK_LIMITS.faqItems}
         blank={BLANK_FAQ_ITEM}
         addLabel={t("block.faq.add")}
       />
@@ -388,7 +379,7 @@ function LocationEditor({ block, onChange }: KindEditorProps<"location">) {
         optional
         multiline
         value={block.note}
-        maxLength={BLOCK_TEXT_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.text}
         onChange={(note) => onChange({ note })}
       />
       <ToggleRow
@@ -413,7 +404,7 @@ function SponsorsEditor({ block, onChange, errorAt }: KindEditorProps<"sponsors"
         errorAt={errorAt}
         rowLabel={(n) => t("block.sponsors.entry", { n })}
         fields={[
-          { key: "name", label: t("block.sponsors.name"), maxLength: ENTRY_NAME_MAX },
+          { key: "name", label: t("block.sponsors.name"), maxLength: EVENT_PAGE_BLOCK_LIMITS.entryName },
           {
             key: "url",
             label: t("block.sponsors.url"),
@@ -422,7 +413,7 @@ function SponsorsEditor({ block, onChange, errorAt }: KindEditorProps<"sponsors"
             maxLength: SAFE_HTTPS_LINK_MAX,
           },
         ]}
-        max={SPONSOR_ENTRIES_MAX}
+        max={EVENT_PAGE_BLOCK_LIMITS.sponsorEntries}
         blank={BLANK_SPONSOR_ENTRY}
         addLabel={t("block.sponsors.add")}
       />
@@ -441,7 +432,7 @@ function DonateEditor({ block, onChange, errorAt }: KindEditorProps<"donate">) {
         optional
         multiline
         value={block.blurb}
-        maxLength={BLOCK_TEXT_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.text}
         onChange={(blurb) => onChange({ blurb })}
       />
       <BlockTextField
@@ -470,7 +461,7 @@ function RegistrationEditor({ block, onChange }: KindEditorProps<"registration">
         optional
         multiline
         value={block.note}
-        maxLength={BLOCK_TEXT_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.text}
         onChange={(note) => onChange({ note })}
       />
     </BlockFields>
@@ -488,7 +479,7 @@ function ContactEditor({ block, onChange, errorAt }: KindEditorProps<"contact">)
         optional
         multiline
         value={block.body}
-        maxLength={BLOCK_TEXT_MAX}
+        maxLength={EVENT_PAGE_BLOCK_LIMITS.text}
         onChange={(body) => onChange({ body })}
       />
       <BlockTextField
diff --git a/apps/community-web/src/features/host/settings/settings-screen.tsx b/apps/community-web/src/features/host/settings/settings-screen.tsx
index 90ec526e..462bc015 100644
--- a/apps/community-web/src/features/host/settings/settings-screen.tsx
+++ b/apps/community-web/src/features/host/settings/settings-screen.tsx
@@ -2,13 +2,12 @@
 
 import { useState } from "react"
 import { useMutation, useQueryClient } from "@tanstack/react-query"
-import { MAX_EVENT_REMINDER_OFFSETS } from "@civfix/shared"
+import { EMAIL_MAX_LENGTH, HTTPS_URL_MAX_LENGTH, MAX_EVENT_REMINDER_OFFSETS } from "@civfix/shared"
 import type { CleanupDTO, EventVisibility, OrganizationDTO } from "@civfix/shared"
 import { datetimeLocalFromIso } from "@civfix/shared/datetime"
 import { useApi, useMyOrganizations } from "@civfix/ui/data"
 import { useT } from "@civfix/ui/i18n"
 
-import { EMAIL_MAX_LENGTH, HTTPS_URL_MAX_LENGTH } from "@/lib/input-limits"
 import { fieldErrorsFrom } from "@/components/console/query-state"
 import { ConsoleButton } from "@/components/console/button"
 import { Field } from "@/components/console/forms/field"
diff --git a/apps/community-web/src/features/host/tickets/questions-editor.tsx b/apps/community-web/src/features/host/tickets/questions-editor.tsx
index efce1b6c..80b311cd 100644
--- a/apps/community-web/src/features/host/tickets/questions-editor.tsx
+++ b/apps/community-web/src/features/host/tickets/questions-editor.tsx
@@ -11,9 +11,11 @@ import type {
   EventQuestionOption,
 } from "@civfix/shared"
 import {
+  MAX_CONSENT_TEXT,
   MAX_EVENT_QUESTIONS,
   MAX_QUESTION_HELP,
   MAX_QUESTION_OPTION_LABEL,
+  MAX_QUESTION_OPTION_VALUE,
   MAX_QUESTION_PROMPT,
 } from "@civfix/shared"
 import { useApi, useEventQuestions } from "@civfix/ui/data"
@@ -41,10 +43,6 @@ const KINDS: readonly EventQuestionKind[] = [
   "consent",
 ]
 
-// The contract's option-value and consent-text maxima, which it does not export.
-const MAX_OPTION_VALUE = 80
-const MAX_CONSENT_TEXT = 2000
-
 export interface DraftQuestion {
   key: string
   id?: string
@@ -79,11 +77,11 @@ export function toDraft(question: EventQuestionDTO): DraftQuestion {
 }
 
 function uniqueValue(label: string, taken: ReadonlySet<string>): string {
-  const base = label.toLowerCase().slice(0, MAX_OPTION_VALUE)
+  const base = label.toLowerCase().slice(0, MAX_QUESTION_OPTION_VALUE)
   if (!taken.has(base)) return base
   for (let n = 2; ; n += 1) {
     const suffix = `-${n}`
-    const candidate = `${base.slice(0, MAX_OPTION_VALUE - suffix.length)}${suffix}`
+    const candidate = `${base.slice(0, MAX_QUESTION_OPTION_VALUE - suffix.length)}${suffix}`
     if (!taken.has(candidate)) return candidate
   }
 }
diff --git a/apps/community-web/src/features/signup-page/blocks/contact-block.tsx b/apps/community-web/src/features/signup-page/blocks/contact-block.tsx
index c013cb9e..4dab08f4 100644
--- a/apps/community-web/src/features/signup-page/blocks/contact-block.tsx
+++ b/apps/community-web/src/features/signup-page/blocks/contact-block.tsx
@@ -2,7 +2,7 @@
 
 import * as React from "react"
 import { useT } from "@civfix/ui/i18n"
-import type { EventPageBlock } from "@civfix/shared"
+import { EMAIL_MAX_LENGTH, type EventPageBlock } from "@civfix/shared"
 
 type ContactBlockData = Extract<EventPageBlock, { kind: "contact" }>
 
@@ -11,7 +11,7 @@ const EMAIL_SHAPE = /^[A-Za-z0-9._+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-
 export function contactMailtoAddress(value: string | null | undefined): string | null {
   if (typeof value !== "string") return null
   const address = value.trim()
-  if (address.length === 0 || address.length > 254) return null
+  if (address.length === 0 || address.length > EMAIL_MAX_LENGTH) return null
   return EMAIL_SHAPE.test(address) ? address : null
 }
 
diff --git a/apps/community-web/src/lib/api.ts b/apps/community-web/src/lib/api.ts
index 8d4687bc..840ddeb6 100644
--- a/apps/community-web/src/lib/api.ts
+++ b/apps/community-web/src/lib/api.ts
@@ -1,12 +1,17 @@
 "use client"
 
+import { stripTrailingSlashes } from "@civfix/shared"
 import { createApiClient, type ApiClient } from "@civfix/shared/client"
 
 import { getCsrfToken, useAuthStore, waitForSessionSettled } from "@/store/auth-store"
 
+const LOCAL_API_URL = "http://localhost:8080"
+
 /** NEXT_PUBLIC_ vars are inlined into the static export, so changing this needs a rebuild. */
+const CONFIGURED_API_URL = process.env.NEXT_PUBLIC_API_URL
+
 export const API_BASE_URL: string =
-  process.env.NEXT_PUBLIC_API_URL?.replace(/\/+$/, "") ?? "http://localhost:8080"
+  CONFIGURED_API_URL === undefined ? LOCAL_API_URL : stripTrailingSlashes(CONFIGURED_API_URL)
 
 /**
  * The Next prerender of the shell has no window, so this falls back to globalThis.fetch and module
diff --git a/apps/community-web/src/lib/input-limits.ts b/apps/community-web/src/lib/input-limits.ts
deleted file mode 100644
index 50cf8e03..00000000
--- a/apps/community-web/src/lib/input-limits.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-// These mirror the @civfix/shared schema maxima so a field stops where the server would refuse the
-// value. The contract does not export them yet; until it does, this is the one web copy.
-export const EMAIL_MAX_LENGTH = 254
-export const HTTPS_URL_MAX_LENGTH = 500
-export const HANDLE_MAX_LENGTH = 20
diff --git a/apps/community-web/src/lib/turnstile.test.ts b/apps/community-web/src/lib/turnstile.test.ts
index 022581ad..f94306c5 100644
--- a/apps/community-web/src/lib/turnstile.test.ts
+++ b/apps/community-web/src/lib/turnstile.test.ts
@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs"
 
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"
+import { ANON_REPORT_TURNSTILE_ACTION, HOME_TURF_TURNSTILE_ACTION } from "@civfix/shared/host"
 
 import type * as TurnstileModule from "@/lib/turnstile"
 
@@ -148,10 +149,10 @@ afterEach(() => {
 describe("turnstile action", () => {
   it("tags the report-submit mint with the action the backend verifies", async () => {
     const { rendered } = stubTurnstile((opts) => opts.callback?.("tok"))
-    const { runTurnstile, TURNSTILE_ACTION_ANON_REPORT } = await loadModule()
+    const { runTurnstile } = await loadModule()
 
     await expect(runTurnstile()).resolves.toBe("tok")
-    expect(rendered[0]?.action).toBe(TURNSTILE_ACTION_ANON_REPORT)
+    expect(rendered[0]?.action).toBe(ANON_REPORT_TURNSTILE_ACTION)
   })
 
   it("mints under the action the caller asks for (the guest-RSVP seam)", async () => {
@@ -163,9 +164,8 @@ describe("turnstile action", () => {
   })
 
   it("keeps the static home-turf form on the action its endpoint verifies", async () => {
-    const { TURNSTILE_ACTION_HOME_TURF } = await loadModule()
     const html = readFileSync(new URL("../../public/home-turf/index.html", import.meta.url), "utf8")
-    expect(html).toContain(`var TURNSTILE_ACTION = '${TURNSTILE_ACTION_HOME_TURF}';`)
+    expect(html).toContain(`var TURNSTILE_ACTION = '${HOME_TURF_TURNSTILE_ACTION}';`)
     expect(html).toContain("action: TURNSTILE_ACTION,")
   })
 })
diff --git a/apps/community-web/src/lib/turnstile.ts b/apps/community-web/src/lib/turnstile.ts
index f4145331..bdd79b55 100644
--- a/apps/community-web/src/lib/turnstile.ts
+++ b/apps/community-web/src/lib/turnstile.ts
@@ -1,5 +1,7 @@
 "use client"
 
+import { ANON_REPORT_TURNSTILE_ACTION } from "@civfix/shared/host"
+
 import { Z_TURNSTILE_CHALLENGE } from "@/styles/z-layers"
 
 const SCRIPT_SRC = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"
@@ -12,9 +14,6 @@ const INTERACTIVE_TIMEOUT_MS = 120000
 
 export const TURNSTILE_SITEKEY: string | undefined = process.env.NEXT_PUBLIC_TURNSTILE_SITEKEY
 
-export const TURNSTILE_ACTION_ANON_REPORT = "anon-report"
-export const TURNSTILE_ACTION_HOME_TURF = "home-turf"
-
 interface TurnstileApi {
   render: (
     el: HTMLElement,
@@ -193,7 +192,7 @@ let mintChain: Promise<unknown> = Promise.resolve()
 let pendingMint: { action: string; promise: Promise<string> } | null = null
 
 export function runTurnstile(
-  action: string = TURNSTILE_ACTION_ANON_REPORT,
+  action: string = ANON_REPORT_TURNSTILE_ACTION,
   timeoutMs = MINT_TIMEOUT_MS,
 ): Promise<string> {
   if (typeof window === "undefined" || !TURNSTILE_SITEKEY) return Promise.resolve("")
diff --git a/apps/community-web/src/lib/ws.ts b/apps/community-web/src/lib/ws.ts
index 0544fc09..8e566f39 100644
--- a/apps/community-web/src/lib/ws.ts
+++ b/apps/community-web/src/lib/ws.ts
@@ -1,5 +1,6 @@
 "use client"
 
+import { stripTrailingSlashes } from "@civfix/shared"
 import { ChatSocketCore, type WsConnection } from "@civfix/ui/realtime"
 
 import { API_BASE_URL } from "@/lib/api"
@@ -16,7 +17,7 @@ import { API_BASE_URL } from "@/lib/api"
 
 export function wsUrlFromApiBase(apiBase: string = API_BASE_URL): string {
   if (typeof window === "undefined") return ""
-  const trimmed = apiBase.replace(/\/+$/, "")
+  const trimmed = stripTrailingSlashes(apiBase)
   let url: URL
   try {
     url = new URL(trimmed, window.location.origin)
@@ -24,7 +25,7 @@ export function wsUrlFromApiBase(apiBase: string = API_BASE_URL): string {
     return ""
   }
   url.protocol = url.protocol === "https:" ? "wss:" : "ws:"
-  url.pathname = `${url.pathname.replace(/\/+$/, "")}/ws`
+  url.pathname = `${stripTrailingSlashes(url.pathname)}/ws`
   url.search = ""
   url.hash = ""
   return url.toString()
diff --git a/packages/shared/CHANGELOG.md b/packages/shared/CHANGELOG.md
index 82ca5278..4aeab881 100644
--- a/packages/shared/CHANGELOG.md
+++ b/packages/shared/CHANGELOG.md
@@ -1,5 +1,51 @@
 # @civfix/shared
 
+## 0.58.0
+
+### Minor Changes
+
+- 7c45af1: Contract cleanup from the civfix-app campaign: unused value exports removed, the schemas' input limits and the helpers ui, web and mobile shared by copy exported once, the optional fields the backend and admin asked for, and a set of behaviour fixes. No endpoint is added or removed and no path, method, auth or csrf flag moves (the registry stays at 333 entries). See DECISIONS §58.
+
+  **Removed.** No consumer used any of these (checked against civfix-backend `services/api` and `services/media-worker`, civfix-admin `apps/admin`, civfix-govt-web, civfix-govt-shared, civfix-app ui and apps, and the open backend and admin PRs).
+
+  - Root `@civfix/shared`: `comparePrecision`, `resetResponseWarnings`, `API_VERSIONS`, `LATEST_API_VERSION`, `isCalendarDay`, `registrationSeries`, `repeatAttendanceRate`, `hourlySeries`, `cumulativeSeries`, `FORWARD_TEMPLATE_VARIABLE_NAMES`, `REPORT_CODE_TO_TYPE`, `WEB_REPORT_TYPE_BY_ID`, `webReportTypeToCategory`, `H3CellSchema` (the `H3Cell` type stays, as `string`), `EventInsightsSchema` (the `EventInsights` type stays; parse with `GetEventInsightsResponseSchema`), `HttpsCtaUrlSchema` (use `HttpsUrlSchema`, which it duplicated), `REPORT_VOLUNTEER_HOURS`, `mixWithWhite`, `chipPairPasses`, and the type `GovTarget`. `WebReportType` loses its `gov` field and `WEB_REPORT_TYPES` entries no longer carry placeholder agency routing.
+  - `@civfix/shared/client`: `resetResponseWarnings`, `API_VERSIONS`, `LATEST_API_VERSION`.
+  - `@civfix/shared/host`: `cumulativeSeries`, `hourlySeries`, `isCalendarDay`, `registrationSeries`, `repeatAttendanceRate`, and the re-export of the safe-URL helpers (`isSafeHttpsUrl`, `isSafeMarkdownHref`, `unsafeHostReason`, `hostOfAuthority`, `httpsUrlAuthority`, `SAFE_HTTPS_URL_MAX_CHARS`, `MARKDOWN_MAX_HREF_CHARS`, `SafeHttpsUrlOptions`, `UnsafeHostReason`), which stay on the root and on `@civfix/shared/markdown`.
+  - `@civfix/shared/geocode`: `ipLocate` (deprecated since 0.47.0; use `getApproximateLocation`).
+  - `@civfix/shared/chip-contrast`: `mixWithWhite`, `chipPairPasses`.
+  - Kept on purpose: every inferred type, `DEFAULT_DURATION_MS` (the backend still imports it), `DiscoveryReviewStatusSchema` and `DISCOVERY_REVIEW_STATUS_LABELS` (civfix-admin is adopting them).
+
+  **Added.**
+
+  - Input limits the schemas already enforced, now named and used by them: `POST_BODY_MAX` (2000), `MAX_EVENT_TITLE` (120), `MAX_EVENT_DESCRIPTION` (2000), `MAX_EVENT_CANCEL_REASON` (500), `MAX_EVENT_RESOURCES_MESSAGE` (2000), `MAX_REPORT_TITLE_LENGTH` (120), `MAX_REPORT_DESCRIPTION_LENGTH` (2000), `MAX_REPORT_MEDIA` (5), `EMAIL_MAX_LENGTH` (254), `HTTPS_URL_MAX_LENGTH` (500), `HANDLE_MAX_LENGTH` (20), `DISPLAY_NAME_MAX_LENGTH` (80), `EMAIL_OTP_CODE_LENGTH` (6), `SOCIAL_HANDLE_MAX_LENGTH` (30), `WHATSAPP_NUMBER_MAX_LENGTH` (15), `SOCIAL_HANDLE_PREFIX` (`facebook.com/`, `instagram.com/`, `tiktok.com/@`, `x.com/`, `+`), `CHAT_GROUP_NAME_MAX` (80), `CHAT_GROUP_DESCRIPTION_MAX` (500), `POLL_QUESTION_MAX` (300), `POLL_OPTION_MAX` (100), `POLL_MIN_OPTIONS` (2), `POLL_MAX_OPTIONS` (10), `MAX_QUESTION_OPTION_VALUE` (80), `MAX_CONSENT_TEXT` (2000), `MAX_ORG_VERIFICATION_NOTE` (1000), `CONTENT_REPORT_DETAILS_MAX` (1000), `MAX_LEADERBOARD_OFFSET` (500), `WS_CLIENT_ID_MAX` (64), and `EVENT_PAGE_BLOCK_LIMITS` (title 160, heroHeadline 160, heroSubhead 320, text 1200, agendaItems 30, agendaTime 40, agendaItemTitle 160, rowDescription 600, hostEntries 20, entryName 120, hostRole 80, faqItems 30, faqQuestion 200, sponsorEntries 20). `SupportedLocaleSchema` names the locale enum the auth schemas use.
+  - Optional fields and enums asked for by the backend and admin: `AnalyticsKpi.key` (open string; known values in `AnalyticsKpiKey`: `pins_this_month`, `resolved`, `cleanups_planned`, `avg_route_time`, `events_this_month`, `new_users`) and `AnalyticsKpi.unit` (`AnalyticsKpiUnitSchema`: `count`, `percent`, `hours`); `HomeSummaryResponse.degraded` (the top-level keys whose query failed and were zero-filled); `MailAttachment.url` (the presigned link `key` already carried, valid 15 minutes); `ModerationItemDTO.status` (`ModerationItemStatusSchema`: `open`, `approved`, `removed`, `held`); `UserMessageItemDTO.removedBy` (`MessageRemovedBySchema`: `author`, `operator`, or null); `DiscoveryContact.bouncedAt`; `flagged` on `FlagEventRequest`, `FlagReportRequest` and `FlagUserRequest` (sets the marker instead of toggling it); `idempotencyKey` on `CreateWalkupRegistrationRequest`; `excludeOrgId` on `AdminUserListQuery`; `ADMIN_REPORT_STATUS_BUCKETS` with `AdminReportStatusBucketSchema` (`submitted`: submitted, held, published; `in_progress`: acknowledged, in_progress; `completed`: resolved); `GUEST_REGISTRATION_ERROR_FIELD` (`"registration"`) and `GuestRegistrationRefusalReason`; optional `retryCount` / `retryLimit` on the Jobs seam's `JobHandlerArg`.
+  - Error helpers: `isErrorCode`, `appErrorCode`, `appErrorFields`, `byErrorCode`, `errorCopyKey`, `ErrorCodeTable`, and `toAppError(value, { fallbackMessage })` (`ToAppErrorOptions`; the default message is still "Unknown error").
+  - Formatters: `safeDateFormat`, `formatEventInstant` (`EventInstantStyle` `short` / `long`, falling back to America/Los_Angeles for a missing or invalid zone), `eventZoneSuffix`, `datetimeLocalFromIso`, `isoFromDatetimeLocal` (`DatetimeLocalValue`), all also on `@civfix/shared/datetime`; `formatCount` (`FormatCountOptions`, with an English short-scale fallback where the engine ignores compact notation) and `formatCertificateHours` on the root.
+  - Host models on the root and `@civfix/shared/host` (zod-free): `normalizeTicketCode`, `ticketCodeReady`, `formatTicketCode`; `checkinResultRender` (`CheckinResultRender`, `CheckinTone`); `checkableSeatIds`, `nextCheckinSeat`, `lastCheckedInSeat`, `attendeeDisplayName` (`AttendeeNameFallbacks`); `questionVisible`, `visibleQuestions`, `answerIsBlank`, `missingRequired`, `answerPayload` (`AnswerMap`), `clampPartySize`, `sortedTicketTypes`, `ticketTypeSelectable`, `defaultTicketTypeId`, `registerOutcomeKey`; `visibleValue`, `visibleRows`, `panelIsBlank`, `seriesValuesForChart`, `seriesIsChartable`, `seriesHasSuppressedPoints`; `weekDayLabel`; `ANON_REPORT_TURNSTILE_ACTION` (`"anon-report"`) and `HOME_TURF_TURNSTILE_ACTION` (`"home-turf"`).
+  - Utilities on the root: `withTimeout`, `DEVICE_FIX_TIMEOUT_MS` (4000), `coordsLabel`, `isUuid`, `stripTrailingSlashes`, and the time units `MS_PER_SECOND`, `MS_PER_MINUTE`, `MS_PER_HOUR`, `MS_PER_DAY`, `MS_PER_WEEK`, `SECONDS_PER_MINUTE`, `SECONDS_PER_HOUR`, `SECONDS_PER_DAY`, `MINUTES_PER_HOUR`. `roundGeocodeCoord` and `GEOCODE_POINT_KEY_DECIMALS` moved into the zod-free geo module; their root exports are unchanged.
+  - WebSocket: `WsErrorCode` (`BAD_FRAME`, `BLOCKED`, `channel_read_only`, `reply_wrong_room`, `reply_deleted_target`) and `WsErrorFrameCode`, the type of the error frame's `code` (still any string at runtime).
+  - `@civfix/shared/legal`: `sourceLink` (`SourceLink`) and `SOURCE_REPO_URL`, the AGPL section 13 link for civfix-app surfaces; a value that is not a commit sha links the repository root.
+  - `SuggestOptions.onError(error, provider)` on `@civfix/shared/geocode`: address suggestion reports a Mapbox or Photon failure it degrades to `[]` (never called for the caller's own abort).
+
+  **Changed behaviour.**
+
+  - `AppError` sets `new.target.prototype`, so a subclass keeps its own prototype and `instanceof` the subclass holds without the subclass re-setting it. `MailSendError` no longer does.
+  - The typed client rejects a 2xx response other than 204 whose body is not JSON (an empty body included) with `AppError` `INTERNAL` ("Response body for HTTP <status> is not JSON", carrying the request id); it used to resolve `undefined`. An abort while the body is read rethrows the abort.
+  - The typed client fills an `:id` path param from a `*Id` field only when exactly one such field exists; with two, the param stays empty and the request is refused instead of taking whichever key came first.
+  - `@civfix/shared` builds with tsup code splitting, so the entry points share one module instance: an `AppError` thrown by `@civfix/shared/client` is `instanceof` the root `AppError`, and a bundle carries one copy of the schemas.
+  - `buildIcs` emits `URL` only when `isSafeHttpsUrl` accepts it (https, no whitespace or control characters, at most 2048 chars, no userinfo, IP literal, punycode or non-ASCII host), so some URLs it used to emit are now left out. `URL` and the `ORGANIZER` mailto are written without TEXT backslash escaping (RFC 5545 3.3.3, 3.3.13), so a `,` or `;` in them is no longer corrupted; an organizer email with a control character is left out.
+  - `inspectBroadcastLinks` flags a `javascript:`, `data:`, `vbscript:`, `file:`, `blob:` or `jar:` scheme wherever it starts a token and is followed by a payload, even after whitespace; `about:` only when followed directly by text. Prose such as "Questions about: parking" and scheme words inside an https URL path such as `/data:foo` are no longer reported as `insecure_scheme`.
+  - `parseFeedScoreCursor` returns the post id lowercased, so a cursor with uppercase hex resolves to the canonical id.
+  - `parseMarkdownSubset` drops the continuation lines of a list item it dropped past the item cap, instead of appending them to the last kept item.
+  - `relativeAgo` renders `""` for an infinite or out-of-range epoch and for a non-finite `now`, instead of "now" or an Invalid Date.
+  - `contrastRatio` and `relativeLuminance` (`@civfix/shared/chip-contrast`) throw `RangeError` for a partly-hex colour such as `#12345z`, which they used to read by its valid prefix.
+  - The datetime helpers reuse their `Intl.DateTimeFormat`s from caches bounded to 64 entries (least recently used goes first). A formatter for the host's default locale or zone (either argument omitted) is built fresh on every call, so a device locale or time zone change shows up at once. `safeDateFormat` and `formatCount` fall back to `en-US` for a malformed locale tag.
+  - Fakes: `FakeChatService` takes an optional clock (`new FakeChatService(now)`) for `createdAt`; the host dashboard fake derives each event's `myCapabilities` from `hostCapabilities` for its role instead of a hand list; `FakeInboundMail` no longer trusts an `x-thread-token` header, scans the `To` and `Cc` addresses, and matches the reply domain and token case-insensitively, like the real adapter.
+
+  **Internal (no API change).** The endpoint registry is one file per domain under `src/client/endpoints/`, composed in `endpoints.ts`; every entry, path, method and flag is identical and only the key order of `Object.keys(endpoints)` changed. Fields two schema files share live in an unexported module. Design token rows alias their colour ramps with identical values. `fakes/hmac.ts` (never on an entry point) is deleted.
+
+  **Adoption.** civfix-backend `services/api` and `services/media-worker` and civfix-admin `apps/admin` move to `^0.58.0`; none imports a removed name. The new optional fields sit on `.strict()` schemas: clients adopt a new response field before the backend emits it, and the backend accepts a new request field before any client sends it (`excludeOrgId` is on a non-strict query and works in either order). civfix-govt-web stays on `^0.24.2` for tokens only, by the open decision in CLAUDE.md §4.2.
+
 ## 0.57.0
 
 ### Minor Changes
diff --git a/packages/shared/DECISIONS.md b/packages/shared/DECISIONS.md
index 16c4f51c..3e562ba1 100644
--- a/packages/shared/DECISIONS.md
+++ b/packages/shared/DECISIONS.md
@@ -31,19 +31,19 @@ submitted | held | published | acknowledged | in_progress | resolved | rejected
 
 The PinIt web design exposes finer-grained issue types than the mobile report flow. Rather than
 expand the canonical category enum (which drives colors and is shared with mobile), each web issue
-type is a separate, data-driven record in `WEB_REPORT_TYPES` that maps to one canonical category and
-a default city agency. The finalized mapping is:
-
-| id             | label                 | canonical category | gov name                           | gov email                 |
-| -------------- | --------------------- | ------------------ | ---------------------------------- | ------------------------- |
-| dump           | Illegal dumping       | trash              | LA Bureau of Sanitation            | sanitation@lacity.gov     |
-| encampment     | Encampment            | encampment         | LA Bureau of Sanitation            | sanitation@lacity.gov     |
-| graffiti       | Graffiti              | graffiti           | Office of Community Beautification | ocb@lacity.gov            |
-| infrastructure | Broken infrastructure | water              | LA Bureau of Street Services       | streetservices@lacity.gov |
-| pavement       | Pavement distress     | hazard             | LA Bureau of Street Services       | streetservices@lacity.gov |
-| vegetation     | Overgrown vegetation  | recycling          | LA Bureau of Street Services       | streetservices@lacity.gov |
-| water          | Water/leak            | water              | LADWP                              | customerservice@ladwp.com |
-| recycling      | Recycling             | recycling          | LA Bureau of Sanitation            | sanitation@lacity.gov     |
+type is a separate, data-driven record in `WEB_REPORT_TYPES` that maps to one canonical category.
+The finalized mapping is:
+
+| id             | label                 | canonical category |
+| -------------- | --------------------- | ------------------ |
+| dump           | Illegal dumping       | trash              |
+| encampment     | Encampment            | encampment         |
+| graffiti       | Graffiti              | graffiti           |
+| infrastructure | Broken infrastructure | water              |
+| pavement       | Pavement distress     | hazard             |
+| vegetation     | Overgrown vegetation  | recycling          |
+| water          | Water/leak            | water              |
+| recycling      | Recycling             | recycling          |
 
 The canonical-category column above is what `REPORT_TYPE_TO_CATEGORY` ships today (the table was
 corrected in 0.52.0 to match the code; it previously described `infrastructure -> hazard` and
@@ -51,11 +51,13 @@ corrected in 0.52.0 to match the code; it previously described `infrastructure -
 and "Overgrown vegetation" to its RECYCLING contact is an open product decision - changing it is a
 contract change with a category backfill, like 0.20.0's `encampment` split.
 
-The `gov` addresses are placeholder routing for Phase 1 and represent the Los Angeles default
-fallback only. Real per-jurisdiction routing comes from the `jurisdictions` table resolved from a
-pin's PostGIS-derived GEOID; when a jurisdiction has no saved contact, a discovery task is queued.
-`WEB_REPORT_TYPES` is the single source of truth and is exposed as an array plus a derived lookup
-(`WEB_REPORT_TYPE_BY_ID`) and a helper (`webReportTypeToCategory`) so it is easy to extend.
+A record carries no routing. Until 0.58.0 each entry also held a `gov` name and email (placeholder Los
+Angeles fallback routing from Phase 1), with a `WEB_REPORT_TYPE_BY_ID` lookup and a
+`webReportTypeToCategory` helper beside the array; nothing read any of them, and 0.58.0 removed all
+three together with the `GovTarget` type (§58). Routing comes only from the `jurisdictions` table
+resolved from a pin's PostGIS-derived GEOID; when a jurisdiction has no saved contact, a discovery
+task is queued. `WEB_REPORT_TYPES` is the single source of truth, exposed as the array and its
+`WebReportTypeId` union.
 
 ## 4. Breaking the entity import cycle: schemas/entities.ts
 
@@ -71,9 +73,11 @@ files while keeping the public naming intact.
 
 ## 5. ISODate as a coercing transform
 
-`ISODateSchema` is `z.coerce.date().transform((d) => d.toISOString())`. It accepts Date objects and
-ISO strings on input and always yields an ISO-8601 string. This keeps server ergonomics (pass a Date)
-while guaranteeing a string on the wire. The exported `ISODate` type is `string`.
+`ISODateSchema` is `z.coerce.date().transform((d) => d.toISOString())` behind a `z.preprocess` that
+lets only a string or a Date through. It accepts Date objects and date strings on input and always
+yields an ISO-8601 string. This keeps server ergonomics (pass a Date) while guaranteeing a string on
+the wire. Any other input (a number, a boolean, `null`) is refused rather than coerced, so an epoch
+number or a stray `null` never turns into a 1970 timestamp. The exported `ISODate` type is `string`.
 
 ## 6. Media size limits via superRefine
 
@@ -807,10 +811,13 @@ is no analytics SDK, no cookie, no identifier, and no per-person series anywhere
   revealable, AND the hidden group from the step to the END of the range is revealable - the
   look-ahead is what lets the terminal number be published: it trades an interior step for the
   total whenever both cannot be safe (`[4, 0, 10, 4]` publishes only `18`). `dailySeries.total`,
-  `cumulativeSeries.total` and the backend's `registered` / `cancelled` KPIs are all gated on the
-  SAME `totalPublishable`, because they are all the same cut at the end of the same chain; a KPI
-  gated only by `suppressCount` would hand back what the series just withheld. The same interval
-  rule gates the totals of `hourlySeries` and `arrivalsCurve`.
+  the last point of the closure's `cumulative` and the backend's `registered` / `cancelled` KPIs are
+  all gated on the SAME `totalPublishable`, because they are all the same cut at the end of the same
+  chain; a KPI gated only by `suppressCount` would hand back what the series just withheld. The same
+  interval rule gates the total of `arrivalsCurve`. (`cumulativeSeries`, a wrapper over the closure,
+  and `hourlySeries`, a separate hourly panel, had no consumer and were removed in 0.58.0, §58; the
+  cumulative invariant tests now run against `seriesClosure().cumulative`, and the hourly tests went
+  with the removed code.)
 - **A breakdown yields to the number it partitions; the KPI never yields to the breakdown.**
   `byTicketType`, `byAudience`, `bySlot`, `bySource`, `byEvent` and the broadcast channel columns
   all sum to a number civfix publishes elsewhere (`registered`, `checkedIn`, the page-view total,
@@ -1430,7 +1437,7 @@ This retires the "geographic centre of the contiguous US" (39.8283, -98.5795) fr
 
 Registry count 344 → 345.
 
-**`ipLocate()` and `GEOJS_URL` (`src/geocode.ts`) are deprecated as of 0.47.0.** They called a third party (get.geojs.io) straight from the client for the same "roughly where is this caller" answer this endpoint now gives first-party, and the consumer plane has no callers left: the report flow's location step, the address-search proximity bias, the create-event initial point and `useUserLocation` all resolve through `getApproximateLocation` (the `useApproximateLocation()` hook, or the imperative `fetchApproximateLocation()` in `@civfix/ui/data`, which share one query-cache entry with the map). The export stays in 0.47.0 because that version is already published and a removal is a recorded 0.x minor (§4.2); it is slated for removal in the next minor, whose DECISIONS entry names the delivery set. Nothing in civfix-backend ever imported it.
+**`ipLocate()` (and its internal `GEOJS_URL` endpoint, `src/geocode.ts`) was deprecated in 0.47.0 and removed in 0.58.0 (§58).** It called a third party (get.geojs.io) straight from the client for the same "roughly where is this caller" answer this endpoint gives first-party. The consumer plane had no callers left: the report flow's location step, the address-search proximity bias, the create-event initial point and `useUserLocation` all resolve through `getApproximateLocation` (the `useApproximateLocation()` hook, or the imperative `fetchApproximateLocation()` in `@civfix/ui/data`, which share one query-cache entry with the map). Nothing in civfix-backend, civfix-admin or the gov plane ever imported it. The web and mobile guard tests that fail the build on a reintroduced `ipLocate` import stay.
 
 ## 46. Platform-processed donations removed; a donation link is an external URL (0.48.0)
 
@@ -1802,9 +1809,12 @@ not computed it yet and a client that never reads it both still parse.
 **Registry shape.** The three new endpoints live in a fourth exported group,
 `adminReportChatEndpoints`, spread into `endpoints` alongside `coreEndpoints`, `hostEndpoints` and
 `hostAdminEndpoints`. `coreEndpoints` had reached the TypeScript declaration-serialization ceiling
-(TS7056), so a new group (not a new key on `coreEndpoints`) is how the registry grows from here. The
+(TS7056), so at the time a new group (not a new key on `coreEndpoints`) was how the registry grew. The
 registry is now 324 entries, 104 of them under `/admin`; the backend's
-`test/unit/route-coverage.test.ts` moves to 324.
+`test/unit/route-coverage.test.ts` moves to 324. **Superseded in 0.58.0 (§58):** the registry is split
+into one file per domain under `src/client/endpoints/`, and each group is typed as the intersection of
+those files' `typeof`s, so the declaration never inlines one huge object type. A new endpoint goes into
+its domain's file; the "new group because of TS7056" rule no longer applies.
 
 ## 53. The feed score is a global term plus a viewer term, and every refresh reshuffles (0.54.0)
 
@@ -2032,8 +2042,152 @@ an already published reply is a no-op that writes no second audit row; a thread
 is refused with CONFLICT because there is nowhere public to publish to.
 
 **Registry.** The two endpoints are a fifth group, `adminInboxEndpoints`, spread into `endpoints` beside
-`adminReportChatEndpoints` for the TS7056 reason §52 gives. The registry moves 331 to 333, 106 of them
-under `/admin`; civfix-backend's `test/unit/route-coverage.test.ts` moves with it. The backend adopts
+`adminReportChatEndpoints` for the TS7056 reason §52 gave (since 0.58.0 both live in per-domain files,
+§58). The registry moves 331 to 333, 106 of them under `/admin`; civfix-backend's `test/unit/route-coverage.test.ts` moves with it. The backend adopts
 0.57.0 for the endpoints and the new fields, and civfix-admin adopts it for the unified Inbox and the
 review action; `services/media-worker` bumps alongside the api and civfix-govt-web with the routine
 propagation. No seam or fake changes.
+
+## 58. Campaign contract cleanup: unused exports removed, limits and shared helpers exported (0.58.0)
+
+The civfix-app cleanup campaign touched `packages/shared` in 36 commits across its PRs 3 to 14. They
+ship as one minor so every registry consumer adopts once. No endpoint is added or removed and no
+path, method, auth or csrf flag moves: the registry stays at 333 entries, and the only shape changes
+are the optional fields listed under the handoff paragraph below.
+
+**Removed: value exports no consumer used (the CLAUDE.md §4.2 0.x removal rule).** Each name below
+was checked on 2026-09-23 and 2026-09-24 against civfix-backend `services/api` and `services/media-worker`,
+civfix-admin `apps/admin`, civfix-govt-web, civfix-govt-shared, civfix-app's ui and apps, the open
+civfix-backend and civfix-admin PRs, and the campaign handoff files. Nothing imported any of them.
+
+| Entry | Removed | Use instead, if anything |
+| --- | --- | --- |
+| root | `comparePrecision` | `ADDRESS_PRECISION_LADDER` order |
+| root, `/client` | `resetResponseWarnings`, `API_VERSIONS`, `LATEST_API_VERSION` | `ApiVersion` / `versionedPath` |
+| root, `/host` | `cumulativeSeries`, `hourlySeries`, `isCalendarDay`, `registrationSeries`, `repeatAttendanceRate` | `seriesClosure`, `dailySeries`, `suppressRate` |
+| root | `FORWARD_TEMPLATE_VARIABLE_NAMES` | `FORWARD_TEMPLATE_VARIABLES` |
+| root | `REPORT_CODE_TO_TYPE` | `REPORT_TYPE_CODE` |
+| root | `WEB_REPORT_TYPE_BY_ID`, `webReportTypeToCategory`, type `GovTarget`, and the `gov` field of `WebReportType` | `WEB_REPORT_TYPES` (§3) |
+| root | `H3CellSchema` (the `H3Cell` type stays, as `string`) | - |
+| root | `EventInsightsSchema` (the `EventInsights` type stays) | `GetEventInsightsResponseSchema` |
+| root | `HttpsCtaUrlSchema` (byte-identical to `HttpsUrlSchema`) | `HttpsUrlSchema` |
+| root | `REPORT_VOLUNTEER_HOURS` | - |
+| root, `/chip-contrast` | `mixWithWhite`, `chipPairPasses` | `contrastRatio` |
+| `/geocode` | `ipLocate` (deprecated since 0.47.0, §45) | `getApproximateLocation` |
+| `/host` | the re-export of `markdown/safe-url` (`isSafeHttpsUrl`, `isSafeMarkdownHref`, `unsafeHostReason`, `hostOfAuthority`, `httpsUrlAuthority`, `SAFE_HTTPS_URL_MAX_CHARS`, `MARKDOWN_MAX_HREF_CHARS`, `SafeHttpsUrlOptions`, `UnsafeHostReason`) | the same names from the root or `/markdown` |
+
+`constantTimeEqual` (`fakes/hmac.ts`) was never reachable from an entry point, so deleting it was not
+a contract change.
+
+**Kept on purpose.** Every inferred `z.infer` type and type alias stays, whatever its use count,
+because the schema and its type are exported side by side (CLAUDE.md §4.1). `DEFAULT_DURATION_MS`
+stays because the backend's insights service imports it (so does open backend PR #99); it goes once
+the backend reads `DEFAULT_EVENT_DURATION_MS`. `DiscoveryReviewStatusSchema` and
+`DISCOVERY_REVIEW_STATUS_LABELS` stay because civfix-admin is adopting them. The web and mobile guard
+tests that refuse an `ipLocate` import stay.
+
+**Why the new modules live in shared.** Everything added is framework-free and replaces copies held
+by the web console, `@civfix/ui` (so web and mobile) or a registry consumer, most of them by more than
+one; one copy is what keeps a client's counter, a server's check and a schema's bound on the same
+number.
+
+- *Input limits and constants* (`POST_BODY_MAX`, `MAX_EVENT_TITLE`, `EMAIL_MAX_LENGTH`,
+  `HTTPS_URL_MAX_LENGTH`, `HANDLE_MAX_LENGTH`, `EVENT_PAGE_BLOCK_LIMITS`, `EMAIL_OTP_CODE_LENGTH`, the
+  poll and group caps, and the rest listed in the CHANGELOG) are the numbers the request schemas
+  already enforce, now named and used by the schemas themselves. The ui, web and mobile copies the campaign
+  found now import them. Field building blocks two schema files share (`schemas/internal-fields.ts`) are deliberately
+  NOT exported: the surface does not grow because two files share a field.
+- *Error helpers* (`isErrorCode`, `appErrorCode`, `appErrorFields`, `byErrorCode`, `errorCopyKey`,
+  `ErrorCodeTable`, `toAppError(value, { fallbackMessage })`) give ui, web and mobile one code to copy
+  mapping. Copy is chosen by code alone; the server's English diagnostic text is never shown.
+  Recognition stays structural (`isAppErrorLike`), because an error from a second copy of the package
+  is never `instanceof` the caller's `AppError`.
+- *Formatters* (`safeDateFormat`, `formatEventInstant`, `eventZoneSuffix`, `datetimeLocalFromIso`,
+  `isoFromDatetimeLocal`, `formatCount`, `formatCertificateHours`) replace the copies in ui, the web
+  console and the web link previews. A malformed locale degrades to `en-US`, never to a blank
+  render, and the date formatters reuse a bounded cache instead of building an `Intl` object per
+  row. `formatCertificateHours` is the one hours format so the printed certificate and the public
+  verify page cannot disagree.
+- *Host models* (`@civfix/shared/host`: ticket codes, check-in result rendering, roster seats,
+  registration questions and ticket types, suppressed analytics views, `weekDayLabel`, the two
+  Turnstile action names) are the rules the web console and the ui host bodies both render. They stay
+  zod-free, like the rest of `/host`, so the console's host bundle does not pull zod in.
+- *Utilities* (`withTimeout`, `DEVICE_FIX_TIMEOUT_MS`, `coordsLabel`, `isUuid`,
+  `stripTrailingSlashes`, the `MS_PER_*` / `SECONDS_PER_*` / `MINUTES_PER_HOUR` units) answer handoff
+  H-018: the backend keeps one copy of each and can adopt these instead. `isUuid` never accepts a
+  value `IdSchema` would refuse. `roundGeocodeCoord` and `GEOCODE_POINT_KEY_DECIMALS` moved from `address.ts` to
+  the zod-free `geo.ts` so the `/geocode` entry stays free of zod; their root exports are unchanged.
+- *Legal* (`/legal`: `sourceLink`, `SOURCE_REPO_URL`) is the AGPL section 13 "Source" link for
+  civfix-app's own surfaces. Anything that is not a commit sha links the repository root, so a bad
+  build value cannot forge the link. civfix-admin links its own repository and does not use it.
+- *WebSocket* (`WsErrorCode`, `WsErrorFrameCode`, `WS_CLIENT_ID_MAX`) names the error frame codes the
+  socket sends beyond `ErrorCode` (the lowercase ones are forwarded `fields.code` subcodes); the
+  frame's `code` stays any string on the wire, so an older client keeps parsing a code added later.
+
+**Additive handoff fields, and the order they are adopted in.** Asked for by the backend and admin
+campaigns: `AnalyticsKpi.key` (an open string; the known values are `AnalyticsKpiKey`) and `.unit`,
+`HomeSummaryResponse.degraded`, `MailAttachment.url`, `ModerationItemDTO.status`,
+`UserMessageItemDTO.removedBy`, `DiscoveryContact.bouncedAt` (responses); `flagged` on
+`FlagEventRequest` / `FlagReportRequest` / `FlagUserRequest` and `idempotencyKey` on
+`CreateWalkupRegistrationRequest` (requests); `excludeOrgId` on `AdminUserListQuery`; plus
+`ADMIN_REPORT_STATUS_BUCKETS`, `GUEST_REGISTRATION_ERROR_FIELD` / `GuestRegistrationRefusalReason`,
+`DISPLAY_NAME_MAX_LENGTH` and the optional `retryCount` / `retryLimit` on `JobHandlerArg`. Every one is
+optional, but the carrying schemas are `.strict()`, which fixes the order:
+
+- A new field on a strict RESPONSE is adopted by every client before the backend emits it. An older
+  client's typed response parse fails on the unknown key, passes the raw body through with one warning
+  and loses the schema's defaults for that call.
+- A new field on a strict REQUEST is IMPLEMENTED by the backend before any client sends it. Accepting
+  it is not enough: a backend that bumps the manifest but still toggles would parse `flagged: true` and
+  unflag an already-flagged item, the retry bug the field exists to fix. An older backend answers
+  VALIDATION.
+- `excludeOrgId` rides a non-strict query, so either order is safe; an older backend strips it and
+  returns the unfiltered page, so admin keeps its client-side filter until the backend filters.
+
+**One module instance per build.** tsup now builds with code splitting: the entry points share chunks
+instead of each re-bundling its imports. Before, `@civfix/shared/client` carried its own copy of the
+schemas and of `AppError`, a Metro bundle shipped both, and `instanceof AppError` failed across
+subpaths. Now a client-thrown `AppError` is `instanceof` the root's. CJS splitting is experimental in
+tsup, so `require` of every exports entry is re-checked after a tsup upgrade. Separately, `AppError`
+sets `new.target.prototype`, so a subclass (`MailSendError`, or a consumer's own) keeps its prototype
+without re-setting it.
+
+**Registry layout.** The registry is one file per domain under `src/client/endpoints/`, composed in
+`endpoints.ts`. Each group is typed as the intersection of its files' `typeof`s, so the declaration no
+longer approaches the TS7056 ceiling; this supersedes §52's "grow by a new group" rule (a new endpoint
+goes into its domain's file). Entries, paths, methods, auth and csrf flags are unchanged; only the
+key order of `Object.keys(endpoints)` moved.
+
+**Delivery set (§4.2, no consumer left behind).** civfix-backend `services/api` and
+`services/media-worker` and civfix-admin `apps/admin` move to `^0.58.0` (range edit and lockfile;
+no code change is required, since none imports a removed name). civfix-govt-web stays on `^0.24.2`
+for tokens only, the open decision CLAUDE.md §4.2 records; nothing it uses was removed. civfix-app's
+web and mobile are workspace consumers and already run this contract.
+
+**Deferred contract decisions.** These requests were not additive-safe or need an owner's call, so
+this release does not attempt them; each needs its own coordinated PR:
+
+- CSRF on `createMediaUpload` / `finalizeMedia` (backend H-001): flip the registry flags once web and
+  admin send the header, then the backend adds `csrfProtect`. A security-posture change.
+- An `oauthNonce` registry entry and the mobile nonce flow (backend H-003): a new entry moves the
+  backend's route-coverage count, so its adoption is not manifest-only.
+- Tightening `SuggestContactRequestSchema` (email 254, formUrl 2048 http/https, geoid 64; backend
+  H-004): a request tightening, not additive.
+- Enum growth: a `DeliveryFailureKind` value, a terminal conflict code, `RegisterOutcome`
+  `slot_full` / `slot_not_found` (backend H-010, H-012). Older clients in the field would fail to parse
+  the new values.
+- `MediaDTO.url` nullable (backend H-013) and the Jobs `enqueue` return type (H-010): both narrow a
+  type every consumer reads.
+- Dropping `.strict()` from response DTOs: 72 of 333 registry responses are strict at the top level,
+  which is what forces the adoption order above.
+- The forward template's hardcoded `https://civfix.org/pin/{reportId}` (staging mail links to
+  production) and its promise of publication for withheld replies: an additive `{reportUrl}` token
+  plus product and counsel wording.
+- Light-scheme category pin contrast: five fills sit under 3:1 on light paper (a design-token
+  decision).
+- One timestamp schema: responses mix `z.string()`, `z.string().datetime()` and `ISODateSchema`; move
+  them together once the backend is confirmed to always emit ISO.
+- Atomic operator writes asked for by admin (H-03 verify-and-send, H-06 save contacts and extras in one
+  request): new endpoints, backend first.
+- `nextCursor` pagination for `listMyOrganizations` and the event team list (backend H-012): an
+  additive request and response change the backend must implement first.
diff --git a/packages/shared/__tests__/address.test.ts b/packages/shared/__tests__/address.test.ts
index 202ab0a3..ca4a8b1a 100644
--- a/packages/shared/__tests__/address.test.ts
+++ b/packages/shared/__tests__/address.test.ts
@@ -2,7 +2,6 @@ import { describe, it, expect } from "vitest"
 
 import {
   ADDRESS_PRECISION_LADDER,
-  comparePrecision,
   geocodePointKey,
   isLocatedPrecision,
   isVerifiedEventAddress,
@@ -39,9 +38,6 @@ describe("address precision ladder", () => {
       "locality",
     ])
     expect(AddressPrecisionSchema.options).toEqual([...ADDRESS_PRECISION_LADDER])
-    expect(comparePrecision("street", "locality")).toBeLessThan(0)
-    expect(comparePrecision("landmark", "intersection")).toBeGreaterThan(0)
-    expect(comparePrecision("street", "street")).toBe(0)
   })
 
   it("treats street/intersection/landmark as located and locality/null as not", () => {
diff --git a/packages/shared/__tests__/admin-schemas.test.ts b/packages/shared/__tests__/admin-schemas.test.ts
index 2e041d22..708b7532 100644
--- a/packages/shared/__tests__/admin-schemas.test.ts
+++ b/packages/shared/__tests__/admin-schemas.test.ts
@@ -39,7 +39,6 @@ import {
   DEFAULT_FORWARD_BODY_TEMPLATE,
   DEFAULT_FORWARD_SUBJECT_TEMPLATE,
   FORWARD_TEMPLATE_SAMPLE_VALUES,
-  FORWARD_TEMPLATE_VARIABLE_NAMES,
   FORWARD_TEMPLATE_VARIABLES,
   PreviewForwardTemplateRequestSchema,
   SetForwardTemplateDefaultRequestSchema,
@@ -300,6 +299,8 @@ describe("discovery schemas", () => {
 })
 
 describe("jurisdictions schemas", () => {
+  const paletteNames = FORWARD_TEMPLATE_VARIABLES.map((v) => v.token.slice(1, -1))
+
   it("SaveContactsRequest takes a per-category email map + form url and rejects a bad category", () => {
     expect(
       SaveContactsRequestSchema.safeParse({
@@ -393,14 +394,12 @@ describe("jurisdictions schemas", () => {
   })
 
   it("the palette never exposes the reporter's identity or an unmodelled department", () => {
-    expect(FORWARD_TEMPLATE_VARIABLE_NAMES).not.toContain("reporterName")
-    expect(FORWARD_TEMPLATE_VARIABLE_NAMES).not.toContain("dept")
+    expect(paletteNames).not.toContain("reporterName")
+    expect(paletteNames).not.toContain("dept")
   })
 
   it("sample values and the built-in defaults cover exactly the palette", () => {
-    expect(Object.keys(FORWARD_TEMPLATE_SAMPLE_VALUES).sort()).toEqual(
-      [...FORWARD_TEMPLATE_VARIABLE_NAMES].sort(),
-    )
+    expect(Object.keys(FORWARD_TEMPLATE_SAMPLE_VALUES).sort()).toEqual([...paletteNames].sort())
     expect(forwardTemplateIssues(DEFAULT_FORWARD_SUBJECT_TEMPLATE)).toEqual([])
     expect(forwardTemplateIssues(DEFAULT_FORWARD_BODY_TEMPLATE)).toEqual([])
     expect(interpolateForwardTemplate(DEFAULT_FORWARD_SUBJECT_TEMPLATE, FORWARD_TEMPLATE_SAMPLE_VALUES)).toBe(
diff --git a/packages/shared/__tests__/client-response-parsing.test.ts b/packages/shared/__tests__/client-response-parsing.test.ts
index b2abf43f..1c215404 100644
--- a/packages/shared/__tests__/client-response-parsing.test.ts
+++ b/packages/shared/__tests__/client-response-parsing.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest"
-import { createApiClient, parseResponse, resetResponseWarnings } from "../src/client/client.js"
-import { endpoints } from "../src/client/endpoints.js"
+import type * as ClientModule from "../src/client/client.js"
+import type * as EndpointsModule from "../src/client/endpoints.js"
 
 /**
  * The typed client parses 2xx bodies against the endpoint's response schema, so the registry's
@@ -42,13 +42,20 @@ function legacyCleanup() {
   }
 }
 
+let createApiClient: typeof ClientModule.createApiClient
+let parseResponse: typeof ClientModule.parseResponse
+let endpoints: typeof EndpointsModule.endpoints
+
 function clientReturning(body: unknown) {
   const fetchImpl = vi.fn(async () => jsonResponse(body)) as unknown as typeof fetch
   return createApiClient({ baseURL: "https://api.civfix.test", fetchImpl })
 }
 
-beforeEach(() => {
-  resetResponseWarnings()
+// A fresh module per test resets the client's once-per-endpoint warning memo.
+beforeEach(async () => {
+  vi.resetModules()
+  ;({ createApiClient, parseResponse } = await import("../src/client/client.js"))
+  ;({ endpoints } = await import("../src/client/endpoints.js"))
 })
 
 afterEach(() => {
@@ -90,3 +97,54 @@ describe("typed client response parsing", () => {
     expect(warn).not.toHaveBeenCalled()
   })
 })
+
+describe("typed client 2xx body decoding", () => {
+  function clientWith(res: () => Response) {
+    const fetchImpl = vi.fn(async () => res()) as unknown as typeof fetch
+    return createApiClient({ baseURL: "https://api.civfix.test", fetchImpl })
+  }
+
+  it("rejects a 2xx body that is not JSON with an INTERNAL AppError carrying the request id", async () => {
+    const client = clientWith(
+      () =>
+        new Response("<html>gateway</html>", {
+          status: 200,
+          headers: { "content-type": "text/html", "x-request-id": "req-1" },
+        }),
+    )
+    await expect(client.listCleanups({})).rejects.toMatchObject({
+      name: "AppError",
+      code: "INTERNAL",
+      httpStatus: 500,
+      requestId: "req-1",
+    })
+  })
+
+  it("rejects an empty 200 body instead of resolving undefined", async () => {
+    const client = clientWith(() => new Response("", { status: 200 }))
+    await expect(client.listCleanups({})).rejects.toMatchObject({ code: "INTERNAL" })
+  })
+
+  it("still resolves a 204 to undefined", async () => {
+    const client = clientWith(() => new Response(null, { status: 204 }))
+    await expect(client.listCleanups({})).resolves.toBeUndefined()
+  })
+
+  it("rethrows the abort, not an AppError, when the caller aborted during the body read", async () => {
+    const controller = new AbortController()
+    controller.abort()
+    const abort = new DOMException("The operation was aborted.", "AbortError")
+    const client = clientWith(
+      () =>
+        ({
+          ok: true,
+          status: 200,
+          headers: new Headers(),
+          json: async () => {
+            throw abort
+          },
+        }) as unknown as Response,
+    )
+    await expect(client.listCleanups({}, { signal: controller.signal })).rejects.toBe(abort)
+  })
+})
diff --git a/packages/shared/__tests__/contract-limits.test.ts b/packages/shared/__tests__/contract-limits.test.ts
new file mode 100644
index 00000000..78d5fbb5
--- /dev/null
+++ b/packages/shared/__tests__/contract-limits.test.ts
@@ -0,0 +1,363 @@
+import { describe, it, expect } from "vitest"
+import * as root from "../src/index.js"
+import * as host from "../src/host/index.js"
+import {
+  ANON_REPORT_TURNSTILE_ACTION,
+  CancelCleanupRequestSchema,
+  CHAT_GROUP_DESCRIPTION_MAX,
+  CHAT_GROUP_NAME_MAX,
+  CreateChatGroupRequestSchema,
+  CreateCleanupRequestSchema,
+  CreatePollRequestSchema,
+  CreateReportRequestSchema,
+  DeleteAccountRequestSchema,
+  DISPLAY_NAME_MAX_LENGTH,
+  EMAIL_MAX_LENGTH,
+  EMAIL_OTP_CODE_LENGTH,
+  EVENT_PAGE_BLOCK_LIMITS,
+  EventPageBlockSchema,
+  EventQuestionDefSchema,
+  GUEST_RSVP_TURNSTILE_ACTION,
+  GuestRsvpRequestRequestSchema,
+  HANDLE_MAX_LENGTH,
+  HANDLE_REGEX,
+  HOME_TURF_TURNSTILE_ACTION,
+  InviteOrganizationMemberRequestSchema,
+  ApplyOrganizationVerificationRequestSchema,
+  HostEventEmailSchema,
+  HTTPS_URL_MAX_LENGTH,
+  HttpsUrlSchema,
+  LeaderboardQuerySchema,
+  LocaleEnum,
+  MAX_CONSENT_TEXT,
+  MAX_EVENT_CANCEL_REASON,
+  MAX_EVENT_DESCRIPTION,
+  MAX_EVENT_RESOURCES_MESSAGE,
+  MAX_EVENT_TITLE,
+  MAX_LEADERBOARD_OFFSET,
+  MAX_ORG_VERIFICATION_NOTE,
+  MAX_QUESTION_OPTION_VALUE,
+  MAX_REPORT_DESCRIPTION_LENGTH,
+  MAX_REPORT_MEDIA,
+  MAX_REPORT_TITLE_LENGTH,
+  OtpCodeSchema,
+  POLL_MAX_OPTIONS,
+  POLL_MIN_OPTIONS,
+  POLL_OPTION_MAX,
+  POLL_QUESTION_MAX,
+  RequestEventResourcesRequestSchema,
+  SOCIAL_HANDLE_MAX_LENGTH,
+  SOCIAL_HANDLE_PREFIX,
+  SOCIAL_PLATFORMS,
+  SocialLinksSchema,
+  SupportedLocaleSchema,
+  UpdateCleanupRequestSchema,
+  UpdateChatGroupRequestSchema,
+  UpdateProfileRequestSchema,
+  VotePollRequestSchema,
+  WHATSAPP_NUMBER_MAX_LENGTH,
+  WS_CLIENT_ID_MAX,
+  WsClientMessageSchema,
+  WsErrorCode,
+  WsServerMessageSchema,
+} from "../src/index.js"
+
+const ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+const ID2 = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb"
+
+function email(length: number): string {
+  const domain = "@example.org"
+  return `${"a".repeat(length - domain.length)}${domain}`
+}
+
+function httpsUrl(length: number): string {
+  const prefix = "https://example.org/"
+  return `${prefix}${"a".repeat(length - prefix.length)}`
+}
+
+describe("exported contract limits are the schema boundaries", () => {
+  it("EMAIL_MAX_LENGTH caps host event, guest and org-invite emails", () => {
+    expect(EMAIL_MAX_LENGTH).toBe(254)
+    expect(HostEventEmailSchema.safeParse(email(EMAIL_MAX_LENGTH)).success).toBe(true)
+    expect(HostEventEmailSchema.safeParse(email(EMAIL_MAX_LENGTH + 1)).success).toBe(false)
+    const invite = (identifier: string) =>
+      InviteOrganizationMemberRequestSchema.safeParse({ id: ID, identifierKind: "email", identifier, role: "member" })
+        .success
+    expect(invite(email(EMAIL_MAX_LENGTH))).toBe(true)
+    expect(invite(email(EMAIL_MAX_LENGTH + 1))).toBe(false)
+    const guest = (value: string) =>
+      GuestRsvpRequestRequestSchema.safeParse({
+        id: ID,
+        name: "Guest",
+        channel: "email",
+        email: value,
+        turnstileToken: "tok",
+      }).success
+    expect(guest(email(EMAIL_MAX_LENGTH))).toBe(true)
+    expect(guest(email(EMAIL_MAX_LENGTH + 1))).toBe(false)
+  })
+
+  it("HTTPS_URL_MAX_LENGTH caps HttpsUrlSchema", () => {
+    expect(HTTPS_URL_MAX_LENGTH).toBe(500)
+    expect(HttpsUrlSchema.safeParse(httpsUrl(HTTPS_URL_MAX_LENGTH)).success).toBe(true)
+    expect(HttpsUrlSchema.safeParse(httpsUrl(HTTPS_URL_MAX_LENGTH + 1)).success).toBe(false)
+  })
+
+  it("HANDLE_MAX_LENGTH is the handle pattern's upper bound, with the pattern text unchanged", () => {
+    expect(HANDLE_MAX_LENGTH).toBe(20)
+    expect(HANDLE_REGEX.source).toBe("^[a-zA-Z0-9_]{3,20}$")
+    expect(HANDLE_REGEX.flags).toBe("")
+    expect(HANDLE_REGEX.test("a".repeat(HANDLE_MAX_LENGTH))).toBe(true)
+    expect(HANDLE_REGEX.test("a".repeat(HANDLE_MAX_LENGTH + 1))).toBe(false)
+  })
+
+  it("DISPLAY_NAME_MAX_LENGTH caps the profile display name", () => {
+    const profile = (displayName: string) =>
+      UpdateProfileRequestSchema.safeParse({ handle: "jane_doe", displayName }).success
+    expect(DISPLAY_NAME_MAX_LENGTH).toBe(80)
+    expect(profile("a".repeat(DISPLAY_NAME_MAX_LENGTH))).toBe(true)
+    expect(profile("a".repeat(DISPLAY_NAME_MAX_LENGTH + 1))).toBe(false)
+  })
+
+  it("social handle and WhatsApp caps bound SocialLinksSchema", () => {
+    const links = (value: Record<string, string>) => SocialLinksSchema.safeParse(value).success
+    expect(SOCIAL_HANDLE_MAX_LENGTH).toBe(30)
+    expect(WHATSAPP_NUMBER_MAX_LENGTH).toBe(15)
+    expect(links({ instagram: "a".repeat(SOCIAL_HANDLE_MAX_LENGTH) })).toBe(true)
+    expect(links({ instagram: "a".repeat(SOCIAL_HANDLE_MAX_LENGTH + 1) })).toBe(false)
+    expect(links({ whatsapp: `1${"2".repeat(WHATSAPP_NUMBER_MAX_LENGTH - 1)}` })).toBe(true)
+    expect(links({ whatsapp: `1${"2".repeat(WHATSAPP_NUMBER_MAX_LENGTH)}` })).toBe(false)
+    expect(links({ whatsapp: "1234567" })).toBe(true)
+    expect(links({ whatsapp: "123456" })).toBe(false)
+    expect(links({ whatsapp: "0234567" })).toBe(false)
+  })
+
+  it("SOCIAL_HANDLE_PREFIX has one display prefix per platform", () => {
+    expect(Object.keys(SOCIAL_HANDLE_PREFIX).sort()).toEqual([...SOCIAL_PLATFORMS].sort())
+    expect(SOCIAL_HANDLE_PREFIX.tiktok).toBe("tiktok.com/@")
+    expect(SOCIAL_HANDLE_PREFIX.whatsapp).toBe("+")
+  })
+
+  it("EMAIL_OTP_CODE_LENGTH is the numeric OTP length for sign-in and account deletion", () => {
+    expect(EMAIL_OTP_CODE_LENGTH).toBe(6)
+    const digits = (n: number) => "1".repeat(n)
+    expect(OtpCodeSchema.safeParse(digits(EMAIL_OTP_CODE_LENGTH)).success).toBe(true)
+    expect(OtpCodeSchema.safeParse(digits(EMAIL_OTP_CODE_LENGTH - 1)).success).toBe(false)
+    expect(OtpCodeSchema.safeParse(digits(EMAIL_OTP_CODE_LENGTH + 1)).success).toBe(false)
+    const del = (emailOtp: string) => DeleteAccountRequestSchema.safeParse({ emailOtp }).success
+    expect(del(digits(EMAIL_OTP_CODE_LENGTH))).toBe(true)
+    expect(del(digits(EMAIL_OTP_CODE_LENGTH + 1))).toBe(false)
+    expect(del("12345a")).toBe(false)
+  })
+
+  it("poll bounds bound CreatePollRequest and VotePollRequest", () => {
+    const poll = (question: string, options: string[]) =>
+      CreatePollRequestSchema.safeParse({ roomKind: "group", roomId: ID, question, options }).success
+    const two = ["a", "b"]
+    expect([POLL_QUESTION_MAX, POLL_OPTION_MAX, POLL_MIN_OPTIONS, POLL_MAX_OPTIONS]).toEqual([300, 100, 2, 10])
+    expect(poll("q".repeat(POLL_QUESTION_MAX), two)).toBe(true)
+    expect(poll("q".repeat(POLL_QUESTION_MAX + 1), two)).toBe(false)
+    expect(poll("q", ["o".repeat(POLL_OPTION_MAX), "b"])).toBe(true)
+    expect(poll("q", ["o".repeat(POLL_OPTION_MAX + 1), "b"])).toBe(false)
+    expect(poll("q", Array.from({ length: POLL_MIN_OPTIONS - 1 }, () => "a"))).toBe(false)
+    expect(poll("q", Array.from({ length: POLL_MAX_OPTIONS }, () => "a"))).toBe(true)
+    expect(poll("q", Array.from({ length: POLL_MAX_OPTIONS + 1 }, () => "a"))).toBe(false)
+    const vote = (optionIdxs: number[]) => VotePollRequestSchema.safeParse({ messageId: ID, optionIdxs }).success
+    expect(vote([POLL_MAX_OPTIONS - 1])).toBe(true)
+    expect(vote([POLL_MAX_OPTIONS])).toBe(false)
+  })
+
+  it("chat group caps bound create and update", () => {
+    expect([CHAT_GROUP_NAME_MAX, CHAT_GROUP_DESCRIPTION_MAX]).toEqual([80, 500])
+    const create = (name: string, description: string) =>
+      CreateChatGroupRequestSchema.safeParse({ name, description }).success
+    expect(create("n".repeat(CHAT_GROUP_NAME_MAX), "d".repeat(CHAT_GROUP_DESCRIPTION_MAX))).toBe(true)
+    expect(create("n".repeat(CHAT_GROUP_NAME_MAX + 1), "")).toBe(false)
+    expect(create("n", "d".repeat(CHAT_GROUP_DESCRIPTION_MAX + 1))).toBe(false)
+    const update = (name: string) => UpdateChatGroupRequestSchema.safeParse({ id: ID, name }).success
+    expect(update("n".repeat(CHAT_GROUP_NAME_MAX))).toBe(true)
+    expect(update("n".repeat(CHAT_GROUP_NAME_MAX + 1))).toBe(false)
+  })
+
+  it("report caps bound CreateReportRequest", () => {
+    const report = (fields: Record<string, unknown>) =>
+      CreateReportRequestSchema.safeParse({
+        idempotencyKey: ID,
+        category: "trash",
+        type: "dump",
+        lat: 34,
+        lng: -118,
+        geomSource: "device",
+        mediaUploadIds: [],
+        ...fields,
+      }).success
+    expect([MAX_REPORT_TITLE_LENGTH, MAX_REPORT_DESCRIPTION_LENGTH, MAX_REPORT_MEDIA]).toEqual([120, 2000, 5])
+    expect(report({})).toBe(true)
+    expect(report({ title: "t".repeat(MAX_REPORT_TITLE_LENGTH) })).toBe(true)
+    expect(report({ title: "t".repeat(MAX_REPORT_TITLE_LENGTH + 1) })).toBe(false)
+    expect(report({ description: "d".repeat(MAX_REPORT_DESCRIPTION_LENGTH) })).toBe(true)
+    expect(report({ description: "d".repeat(MAX_REPORT_DESCRIPTION_LENGTH + 1) })).toBe(false)
+    expect(report({ mediaUploadIds: Array.from({ length: MAX_REPORT_MEDIA }, () => ID) })).toBe(true)
+    expect(report({ mediaUploadIds: Array.from({ length: MAX_REPORT_MEDIA + 1 }, () => ID) })).toBe(false)
+  })
+
+  it("event caps bound create, update, cancel and the resources request", () => {
+    expect([MAX_EVENT_TITLE, MAX_EVENT_DESCRIPTION, MAX_EVENT_CANCEL_REASON, MAX_EVENT_RESOURCES_MESSAGE]).toEqual([
+      120, 2000, 500, 2000,
+    ])
+    const update = (fields: Record<string, unknown>) =>
+      UpdateCleanupRequestSchema.safeParse({ id: ID, ...fields }).success
+    expect(update({ title: "t".repeat(MAX_EVENT_TITLE) })).toBe(true)
+    expect(update({ title: "t".repeat(MAX_EVENT_TITLE + 1) })).toBe(false)
+    expect(update({ description: "d".repeat(MAX_EVENT_DESCRIPTION) })).toBe(true)
+    expect(update({ description: "d".repeat(MAX_EVENT_DESCRIPTION + 1) })).toBe(false)
+    expect(CreateCleanupRequestSchema.shape.title.maxLength).toBe(MAX_EVENT_TITLE)
+    const cancel = (reason: string) => CancelCleanupRequestSchema.safeParse({ id: ID, reason }).success
+    expect(cancel("r".repeat(MAX_EVENT_CANCEL_REASON))).toBe(true)
+    expect(cancel("r".repeat(MAX_EVENT_CANCEL_REASON + 1))).toBe(false)
+    const resources = (message: string) =>
+      RequestEventResourcesRequestSchema.safeParse({ id: ID, message }).success
+    expect(resources("m".repeat(MAX_EVENT_RESOURCES_MESSAGE))).toBe(true)
+    expect(resources("m".repeat(MAX_EVENT_RESOURCES_MESSAGE + 1))).toBe(false)
+  })
+
+  it("EVENT_PAGE_BLOCK_LIMITS bound the page block fields", () => {
+    const block = (value: Record<string, unknown>) => EventPageBlockSchema.safeParse({ id: "b1", ...value }).success
+    const L = EVENT_PAGE_BLOCK_LIMITS
+    const text = (n: number) => "x".repeat(n)
+    expect(block({ kind: "hero", headline: text(L.heroHeadline), subhead: text(L.heroSubhead) })).toBe(true)
+    expect(block({ kind: "hero", headline: text(L.heroHeadline + 1) })).toBe(false)
+    expect(block({ kind: "hero", subhead: text(L.heroSubhead + 1) })).toBe(false)
+    expect(block({ kind: "location", title: text(L.title), note: text(L.text) })).toBe(true)
+    expect(block({ kind: "location", title: text(L.title + 1) })).toBe(false)
+    expect(block({ kind: "location", note: text(L.text + 1) })).toBe(false)
+    const agendaItem = { time: text(L.agendaTime), title: text(L.agendaItemTitle), description: text(L.rowDescription) }
+    expect(block({ kind: "agenda", items: Array.from({ length: L.agendaItems }, () => agendaItem) })).toBe(true)
+    expect(block({ kind: "agenda", items: Array.from({ length: L.agendaItems + 1 }, () => agendaItem) })).toBe(false)
+    expect(block({ kind: "agenda", items: [{ ...agendaItem, time: text(L.agendaTime + 1) }] })).toBe(false)
+    expect(block({ kind: "agenda", items: [{ ...agendaItem, title: text(L.agendaItemTitle + 1) }] })).toBe(false)
+    expect(block({ kind: "agenda", items: [{ ...agendaItem, description: text(L.rowDescription + 1) }] })).toBe(false)
+    const hostEntry = { name: text(L.entryName), role: text(L.hostRole), bio: text(L.rowDescription) }
+    expect(block({ kind: "hosts", entries: Array.from({ length: L.hostEntries }, () => hostEntry) })).toBe(true)
+    expect(block({ kind: "hosts", entries: Array.from({ length: L.hostEntries + 1 }, () => hostEntry) })).toBe(false)
+    expect(block({ kind: "hosts", entries: [{ ...hostEntry, name: text(L.entryName + 1) }] })).toBe(false)
+    expect(block({ kind: "hosts", entries: [{ ...hostEntry, role: text(L.hostRole + 1) }] })).toBe(false)
+    expect(block({ kind: "hosts", entries: [{ ...hostEntry, bio: text(L.rowDescription + 1) }] })).toBe(false)
+    const faq = { question: text(L.faqQuestion), answer: text(L.text) }
+    expect(block({ kind: "faq", items: Array.from({ length: L.faqItems }, () => faq) })).toBe(true)
+    expect(block({ kind: "faq", items: Array.from({ length: L.faqItems + 1 }, () => faq) })).toBe(false)
+    expect(block({ kind: "faq", items: [{ ...faq, question: text(L.faqQuestion + 1) }] })).toBe(false)
+    expect(block({ kind: "faq", items: [{ ...faq, answer: text(L.text + 1) }] })).toBe(false)
+    const sponsor = { name: text(L.entryName) }
+    expect(block({ kind: "sponsors", entries: Array.from({ length: L.sponsorEntries }, () => sponsor) })).toBe(true)
+    expect(block({ kind: "sponsors", entries: Array.from({ length: L.sponsorEntries + 1 }, () => sponsor) })).toBe(
+      false,
+    )
+    expect(block({ kind: "donate", blurb: text(L.text + 1) })).toBe(false)
+    expect(block({ kind: "registration", note: text(L.text + 1) })).toBe(false)
+    expect(block({ kind: "contact", body: text(L.text + 1) })).toBe(false)
+  })
+
+  it("MAX_ORG_VERIFICATION_NOTE caps the verification note", () => {
+    const submit = (note: string) =>
+      ApplyOrganizationVerificationRequestSchema.safeParse({ id: ID, kind: "community", note }).success
+    expect(MAX_ORG_VERIFICATION_NOTE).toBe(1000)
+    expect(submit("n".repeat(MAX_ORG_VERIFICATION_NOTE))).toBe(true)
+    expect(submit("n".repeat(MAX_ORG_VERIFICATION_NOTE + 1))).toBe(false)
+  })
+
+  it("MAX_CONSENT_TEXT and MAX_QUESTION_OPTION_VALUE bound the question definitions", () => {
+    expect([MAX_CONSENT_TEXT, MAX_QUESTION_OPTION_VALUE]).toEqual([2000, 80])
+    const consent = (consentText: string) =>
+      EventQuestionDefSchema.safeParse({ kind: "consent", prompt: "Agree?", consentText }).success
+    expect(consent("c".repeat(MAX_CONSENT_TEXT))).toBe(true)
+    expect(consent("c".repeat(MAX_CONSENT_TEXT + 1))).toBe(false)
+    const choice = (value: string) =>
+      EventQuestionDefSchema.safeParse({
+        kind: "single_select",
+        prompt: "Pick",
+        options: [{ value, label: "One" }],
+      }).success
+    expect(choice("v".repeat(MAX_QUESTION_OPTION_VALUE))).toBe(true)
+    expect(choice("v".repeat(MAX_QUESTION_OPTION_VALUE + 1))).toBe(false)
+  })
+
+  it("MAX_LEADERBOARD_OFFSET caps the leaderboard offset", () => {
+    const board = (offset: number) => LeaderboardQuerySchema.safeParse({ geoid: "06037", offset }).success
+    expect(MAX_LEADERBOARD_OFFSET).toBe(500)
+    expect(board(MAX_LEADERBOARD_OFFSET)).toBe(true)
+    expect(board(MAX_LEADERBOARD_OFFSET + 1)).toBe(false)
+  })
+
+  it("WS_CLIENT_ID_MAX caps the send frame's clientId", () => {
+    const send = (clientId: string) =>
+      WsClientMessageSchema.safeParse({ type: "send", cleanupId: ID, clientId, body: "hi" }).success
+    expect(WS_CLIENT_ID_MAX).toBe(64)
+    expect(send("c".repeat(WS_CLIENT_ID_MAX))).toBe(true)
+    expect(send("c".repeat(WS_CLIENT_ID_MAX + 1))).toBe(false)
+  })
+})
+
+describe("WsErrorCode", () => {
+  it("names the socket-only codes the server sends", () => {
+    expect(Object.values(WsErrorCode).sort()).toEqual(
+      ["BAD_FRAME", "BLOCKED", "channel_read_only", "reply_deleted_target", "reply_wrong_room"].sort(),
+    )
+  })
+
+  it("keeps the error frame open to any string code, known or not", () => {
+    for (const code of [...Object.values(WsErrorCode), "FORBIDDEN", "some_future_code", ""]) {
+      const parsed = WsServerMessageSchema.safeParse({ type: "error", code, message: "no", cleanupId: ID2 })
+      expect(parsed.success, code).toBe(true)
+      if (parsed.success && parsed.data.type === "error") expect(parsed.data.code).toBe(code)
+    }
+    expect(WsServerMessageSchema.safeParse({ type: "error", code: 7, message: "no" }).success).toBe(false)
+  })
+})
+
+describe("turnstile actions", () => {
+  it("are the action strings the backend verifies, exported from both the root and /host", () => {
+    expect([GUEST_RSVP_TURNSTILE_ACTION, ANON_REPORT_TURNSTILE_ACTION, HOME_TURF_TURNSTILE_ACTION]).toEqual([
+      "guest-rsvp",
+      "anon-report",
+      "home-turf",
+    ])
+    expect(host.ANON_REPORT_TURNSTILE_ACTION).toBe(ANON_REPORT_TURNSTILE_ACTION)
+    expect(host.HOME_TURF_TURNSTILE_ACTION).toBe(HOME_TURF_TURNSTILE_ACTION)
+  })
+})
+
+describe("SupportedLocaleSchema", () => {
+  it("is the same schema as LocaleEnum", () => {
+    expect(SupportedLocaleSchema).toBe(LocaleEnum)
+    expect(root.SupportedLocaleSchema.options).toEqual(["en", "es", "de", "ko"])
+  })
+})
+
+describe("guest registration refusal reasons", () => {
+  it("names the field and the reasons the backend refuses a guest registration with", async () => {
+    const { GUEST_REGISTRATION_ERROR_FIELD, GuestRegistrationRefusalReason } = await import("../src/index.js")
+    expect(GUEST_REGISTRATION_ERROR_FIELD).toBe("registration")
+    expect(Object.values(GuestRegistrationRefusalReason).sort()).toEqual([
+      "access_code_invalid",
+      "access_code_required",
+      "answers_invalid",
+      "event_closed",
+      "party_too_large",
+      "registration_closed",
+      "sales_closed",
+      "sold_out",
+      "ticket_type_unavailable",
+    ])
+  })
+})
+
+describe("content report details", () => {
+  it("caps the free-text detail at CONTENT_REPORT_DETAILS_MAX", async () => {
+    const { CONTENT_REPORT_DETAILS_MAX, ReportContentRequestSchema } = await import("../src/index.js")
+    expect(CONTENT_REPORT_DETAILS_MAX).toBe(1000)
+    const base = { subjectType: "post", subjectId: "00000000-0000-4000-8000-000000000001", reason: "spam" }
+    expect(ReportContentRequestSchema.safeParse({ ...base, details: "a".repeat(1000) }).success).toBe(true)
+    expect(ReportContentRequestSchema.safeParse({ ...base, details: "a".repeat(1001) }).success).toBe(false)
+  })
+})
diff --git a/packages/shared/__tests__/errors.test.ts b/packages/shared/__tests__/errors.test.ts
index f601fd11..1c07a858 100644
--- a/packages/shared/__tests__/errors.test.ts
+++ b/packages/shared/__tests__/errors.test.ts
@@ -8,6 +8,8 @@ import {
   byErrorCode,
   errorCopyKey,
   isAppErrorLike,
+  isErrorCode,
+  MailSendError,
   toAppError,
 } from "../src/types/errors.js"
 import { AppErrorSchema } from "../src/schemas/common.js"
@@ -81,6 +83,27 @@ describe("AppError", () => {
     expect(err.message).toBe("missing")
   })
 
+  it("keeps a subclass's own prototype, so instanceof and subclass members survive", () => {
+    class DeadlineError extends AppError {
+      constructor() {
+        super(ErrorCode.INTERNAL, "deadline")
+      }
+      isDeadline(): boolean {
+        return true
+      }
+    }
+    const err = new DeadlineError()
+    expect(err).toBeInstanceOf(DeadlineError)
+    expect(err).toBeInstanceOf(AppError)
+    expect(err.isDeadline()).toBe(true)
+
+    const mail = new MailSendError(ErrorCode.INTERNAL, "smtp down", { responseCode: 421 })
+    expect(mail).toBeInstanceOf(MailSendError)
+    expect(mail).toBeInstanceOf(AppError)
+    expect(mail.smtp).toEqual({ responseCode: 421 })
+    expect(mail.name).toBe("MailSendError")
+  })
+
   it("serializes to the wire envelope and validates against AppErrorSchema", () => {
     const err = new AppError(ErrorCode.VALIDATION, "bad", {
       fields: { x: "y" },
@@ -179,6 +202,31 @@ describe("toAppError", () => {
   })
 })
 
+describe("isErrorCode", () => {
+  it("accepts every ErrorCode value and nothing else", () => {
+    for (const code of Object.values(ErrorCode)) expect(isErrorCode(code)).toBe(true)
+    for (const value of ["BOGUS", "not_found", "", undefined, null, 404, {}]) {
+      expect(isErrorCode(value)).toBe(false)
+    }
+  })
+})
+
+describe("toAppError fallbackMessage", () => {
+  it("uses the caller's fallback for a non-Error throw and for an empty message", () => {
+    const opts = { fallbackMessage: "Network request failed" }
+    expect(toAppError("boom", opts).message).toBe("Network request failed")
+    expect(toAppError(new Error(""), opts).message).toBe("Network request failed")
+    expect(toAppError({ code: ErrorCode.CONFLICT, message: "" }, opts).message).toBe(
+      "Network request failed",
+    )
+  })
+
+  it("keeps the value's own message over a fallback, and the default fallback when no option is given", () => {
+    expect(toAppError(new Error("offline"), { fallbackMessage: "x" }).message).toBe("offline")
+    expect(toAppError("boom").message).toBe("Unknown error")
+  })
+})
+
 describe("isAppErrorLike", () => {
   it("accepts any object carrying a known ErrorCode and a string message", () => {
     expect(isAppErrorLike({ code: ErrorCode.CONFLICT, message: "Already exists" })).toBe(true)
diff --git a/packages/shared/__tests__/fakes.test.ts b/packages/shared/__tests__/fakes.test.ts
index ea655ae6..923762bc 100644
--- a/packages/shared/__tests__/fakes.test.ts
+++ b/packages/shared/__tests__/fakes.test.ts
@@ -107,6 +107,32 @@ describe("FakeInboundMail", () => {
   })
 })
 
+describe("FakeInboundMail thread token parity with the real adapter", () => {
+  it("ignores a spoofable X-Thread-Token header", async () => {
+    const m = new FakeInboundMail()
+    const mail = await m.parse(
+      enc.encode("To: clerk@lacity.gov\nX-Thread-Token: abcdefgh1234\n\nhi"),
+    )
+    expect(m.extractThreadToken(mail)).toBeNull()
+  })
+
+  it("finds a reply address in Cc when To is the city clerk", async () => {
+    const m = new FakeInboundMail()
+    const mail = await m.parse(
+      enc.encode(
+        'To: clerk@lacity.gov\nCc: "Ops" <ops@lacity.gov>, report-k7m2x9q4ab3d@civfix.org\n\nhi',
+      ),
+    )
+    expect(m.extractThreadToken(mail)).toBe("k7m2x9q4ab3d")
+  })
+
+  it("lowercases the address before matching, like the real adapter", async () => {
+    const m = new FakeInboundMail()
+    const mail = await m.parse(enc.encode("To: Report-K7M2X9Q4AB3D@CivFix.org\n\nhi"))
+    expect(m.extractThreadToken(mail)).toBe("k7m2x9q4ab3d")
+  })
+})
+
 describe("FakeChatService", () => {
   it("broadcast reaches a joined connection and history paginates", async () => {
     const chat = new FakeChatService()
@@ -132,6 +158,15 @@ describe("FakeChatService", () => {
   })
 })
 
+describe("FakeChatService clock", () => {
+  it("stamps createdAt from the injected clock", async () => {
+    const at = Date.parse("2026-05-16T16:00:00.000Z")
+    const chat = new FakeChatService(() => at)
+    const msg = await chat.persist({ cleanupId: "cleanup-1", userId: "user-1", body: "hello" })
+    expect(msg.createdAt).toBe("2026-05-16T16:00:00.000Z")
+  })
+})
+
 describe("FakeUserChannel", () => {
   it("delivers a signal frame only to the targeted user's connections and captures the publish", async () => {
     const ch = new FakeUserChannel()
diff --git a/packages/shared/__tests__/geocode.test.ts b/packages/shared/__tests__/geocode.test.ts
index 87815935..a78de440 100644
--- a/packages/shared/__tests__/geocode.test.ts
+++ b/packages/shared/__tests__/geocode.test.ts
@@ -5,14 +5,12 @@ import {
   photonSuggest,
   mapboxSuggest,
   suggestAddresses,
-  ipLocate,
 } from "../src/geocode.js"
 
 /**
- * Tests for the unified forward geocoder. parseLatLng is pure; photonSuggest, mapboxSuggest,
- * suggestAddresses, and ipLocate are exercised against a stubbed global fetch so the coordinate
- * short-circuit, the Mapbox->Photon fallback, abort propagation, and the IP lookup are covered without
- * hitting Photon / Mapbox / GeoJS.
+ * Tests for the unified forward geocoder. parseLatLng is pure; photonSuggest, mapboxSuggest and
+ * suggestAddresses are exercised against a stubbed global fetch so the coordinate short-circuit, the
+ * Mapbox->Photon fallback and abort propagation are covered without hitting Photon / Mapbox.
  */
 
 afterEach(() => {
@@ -296,6 +294,46 @@ describe("suggestAddresses", () => {
   })
 })
 
+describe("suggestAddresses onError", () => {
+  it("reports a Photon outage while still resolving []", async () => {
+    vi.stubGlobal("fetch", vi.fn(async () => new Response("down", { status: 503 })))
+    const onError = vi.fn()
+    await expect(suggestAddresses("echo park", { onError })).resolves.toEqual([])
+    expect(onError).toHaveBeenCalledTimes(1)
+    expect(onError.mock.calls[0]?.[1]).toBe("photon")
+    expect(String(onError.mock.calls[0]?.[0])).toContain("503")
+  })
+
+  it("reports a Mapbox failure it falls back past, then the Photon result wins", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (url: string | URL) =>
+        String(url).includes("mapbox.com")
+          ? new Response("err", { status: 500 })
+          : photonResponse([{ lat: 34.0, lng: -118.2, props: { name: "Echo Park" } }]),
+      ),
+    )
+    const onError = vi.fn()
+    const out = await suggestAddresses("echo park", { mapboxToken: "pk.test", onError })
+    expect(out[0]?.source).toBe("photon")
+    expect(onError.mock.calls.map((call) => call[1])).toEqual(["mapbox"])
+  })
+
+  it("is not called for the caller's own abort", async () => {
+    const controller = new AbortController()
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        controller.abort()
+        throw Object.assign(new Error("aborted"), { name: "AbortError" })
+      }),
+    )
+    const onError = vi.fn()
+    await expect(suggestAddresses("echo", { signal: controller.signal, onError })).rejects.toThrow()
+    expect(onError).not.toHaveBeenCalled()
+  })
+})
+
 describe("suggestion language/country options", () => {
   it("forwards a supported language to Photon and falls back to English for the rest", async () => {
     const urls: string[] = []
@@ -329,18 +367,3 @@ describe("suggestion language/country options", () => {
     expect(new URL(urls[1]!).searchParams.get("country")).toBeNull()
   })
 })
-
-describe("ipLocate", () => {
-  it("parses lat/lng from GeoJS", async () => {
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(async () => new Response(JSON.stringify({ latitude: "34.05", longitude: "-118.24" }), { status: 200 })),
-    )
-    expect(await ipLocate()).toEqual({ lat: 34.05, lng: -118.24 })
-  })
-
-  it("returns null on failure", async () => {
-    vi.stubGlobal("fetch", vi.fn(async () => new Response("nope", { status: 500 })))
-    expect(await ipLocate()).toBeNull()
-  })
-})
diff --git a/packages/shared/__tests__/handoff-additions.test.ts b/packages/shared/__tests__/handoff-additions.test.ts
new file mode 100644
index 00000000..2d70575a
--- /dev/null
+++ b/packages/shared/__tests__/handoff-additions.test.ts
@@ -0,0 +1,237 @@
+import { describe, expect, it } from "vitest"
+import {
+  ADMIN_REPORT_STATUS_BUCKETS,
+  AdminOkResponseSchema,
+  AdminReportStatusBucketSchema,
+  AdminReportStatusSchema,
+  ModerationItemStatusSchema,
+} from "../src/schemas/admin/common.js"
+import { MailAttachmentSchema } from "../src/schemas/admin/mail.js"
+import {
+  AdminUserListQuerySchema,
+  FlagUserRequestSchema,
+  UserMessageItemDTOSchema,
+  UserSubListQuerySchema,
+} from "../src/schemas/admin/users.js"
+import { FlagEventRequestSchema } from "../src/schemas/admin/events.js"
+import { FlagReportRequestSchema, SetReportVerdictResponseSchema } from "../src/schemas/admin/reports.js"
+import { ModerationItemDTOSchema } from "../src/schemas/admin/moderation.js"
+import { DiscoveryContactSchema } from "../src/schemas/admin/discovery.js"
+import { AnalyticsKpiKey, AnalyticsKpiSchema } from "../src/schemas/admin/analytics.js"
+import { HomeSummaryResponseSchema } from "../src/schemas/admin/home.js"
+import { CreateWalkupRegistrationRequestSchema } from "../src/schemas/host/registrations.js"
+
+const UUID = "11111111-2222-4333-8444-555555555555"
+
+describe("ADMIN_REPORT_STATUS_BUCKETS", () => {
+  it("holds the backend's status buckets exactly", () => {
+    expect(ADMIN_REPORT_STATUS_BUCKETS).toEqual({
+      submitted: ["submitted", "held", "published"],
+      in_progress: ["acknowledged", "in_progress"],
+      completed: ["resolved"],
+    })
+  })
+
+  it("keys every bucket the schema names and puts every live status in exactly one bucket", () => {
+    expect(Object.keys(ADMIN_REPORT_STATUS_BUCKETS).sort()).toEqual(
+      [...AdminReportStatusBucketSchema.options].sort(),
+    )
+    const bucketed = Object.values(ADMIN_REPORT_STATUS_BUCKETS).flat()
+    expect(new Set(bucketed).size).toBe(bucketed.length)
+    const unbucketed = AdminReportStatusSchema.options.filter((s) => !bucketed.includes(s))
+    expect(unbucketed).toEqual(["rejected"])
+  })
+})
+
+describe("MailAttachmentSchema url", () => {
+  const attachment = { key: "https://r2.example/a.pdf?sig=1", filename: "a.pdf", size: 10 }
+
+  it("still parses a payload without url", () => {
+    expect(MailAttachmentSchema.safeParse(attachment).success).toBe(true)
+  })
+
+  it("parses a url and rejects a non-url", () => {
+    expect(MailAttachmentSchema.safeParse({ ...attachment, url: attachment.key }).success).toBe(true)
+    expect(MailAttachmentSchema.safeParse({ ...attachment, url: "inbound/a.pdf" }).success).toBe(false)
+  })
+})
+
+describe("AdminUserListQuerySchema excludeOrgId", () => {
+  it("stays optional and non-strict", () => {
+    expect(AdminUserListQuerySchema.safeParse({}).success).toBe(true)
+    expect(AdminUserListQuerySchema.safeParse({ echoed: "x" }).success).toBe(true)
+  })
+
+  it("accepts an org id and rejects a non-uuid", () => {
+    expect(AdminUserListQuerySchema.parse({ excludeOrgId: UUID }).excludeOrgId).toBe(UUID)
+    expect(AdminUserListQuerySchema.safeParse({ excludeOrgId: "org-1" }).success).toBe(false)
+  })
+})
+
+describe("UserSubListQuerySchema cursor", () => {
+  it("parses the same inputs as before", () => {
+    expect(UserSubListQuerySchema.safeParse({ id: "u" }).success).toBe(true)
+    expect(UserSubListQuerySchema.parse({ id: "u", cursor: "abc" }).cursor).toBe("abc")
+    expect(UserSubListQuerySchema.safeParse({ id: "u", cursor: 5 }).success).toBe(false)
+    expect(UserSubListQuerySchema.safeParse({ id: "u", echoed: 1 }).success).toBe(true)
+  })
+})
+
+describe("UserMessageItemDTOSchema removedBy", () => {
+  const message = { id: "m", text: "hi", thread: "t", when: "now", sourceId: null }
+
+  it("still parses a payload without removedBy", () => {
+    expect(UserMessageItemDTOSchema.safeParse(message).success).toBe(true)
+  })
+
+  it("parses author, operator and null, and rejects anything else", () => {
+    for (const removedBy of ["author", "operator", null]) {
+      expect(UserMessageItemDTOSchema.safeParse({ ...message, removedBy }).success).toBe(true)
+    }
+    expect(UserMessageItemDTOSchema.safeParse({ ...message, removedBy: "system" }).success).toBe(false)
+  })
+})
+
+describe("flag requests flagged", () => {
+  const schemas = [FlagEventRequestSchema, FlagReportRequestSchema, FlagUserRequestSchema]
+
+  it("still parses a toggle request", () => {
+    for (const schema of schemas) expect(schema.safeParse({ id: "x" }).success).toBe(true)
+  })
+
+  it("parses an explicit value and rejects a non-boolean", () => {
+    for (const schema of schemas) {
+      expect(schema.parse({ id: "x", flagged: false }).flagged).toBe(false)
+      expect(schema.safeParse({ id: "x", flagged: "yes" }).success).toBe(false)
+    }
+  })
+})
+
+describe("SetReportVerdictResponseSchema", () => {
+  it("is the admin ok schema, still strict", () => {
+    expect(SetReportVerdictResponseSchema).toBe(AdminOkResponseSchema)
+    expect(SetReportVerdictResponseSchema.safeParse({ ok: true }).success).toBe(true)
+    expect(SetReportVerdictResponseSchema.safeParse({ ok: true, extra: 1 }).success).toBe(false)
+    expect(SetReportVerdictResponseSchema.safeParse({ ok: false }).success).toBe(false)
+  })
+})
+
+describe("ModerationItemDTOSchema status", () => {
+  const item = {
+    id: "MOD-1",
+    flag: "NSFW image",
+    reporter: "Anonymous session",
+    category: "graffiti",
+    reason: "Auto-held",
+    age: "12m",
+    priority: "high",
+    kind: "image",
+    subjectId: "REP-42",
+    reporterId: null,
+    desc: "Held photo",
+    autoAction: null,
+    place: null,
+    signals: [],
+    user: {
+      id: null,
+      handle: "anon",
+      name: "Anon",
+      joined: "today",
+      priorReports: 0,
+      priorRemovals: 0,
+      strikes: 0,
+      device: "iOS",
+    },
+    similar: [],
+    media: [],
+  }
+
+  it("still parses a payload without status", () => {
+    expect(ModerationItemDTOSchema.safeParse(item).success).toBe(true)
+  })
+
+  it("parses every stored status and rejects an unknown one", () => {
+    for (const status of ModerationItemStatusSchema.options) {
+      expect(ModerationItemDTOSchema.safeParse({ ...item, status }).success).toBe(true)
+    }
+    expect(ModerationItemDTOSchema.safeParse({ ...item, status: "resolved" }).success).toBe(false)
+  })
+})
+
+describe("DiscoveryContactSchema bouncedAt", () => {
+  const contact = { category: "graffiti", email: "city@example.gov" }
+
+  it("still parses a payload without bouncedAt", () => {
+    expect(DiscoveryContactSchema.safeParse(contact).success).toBe(true)
+  })
+
+  it("parses a timestamp or null", () => {
+    const at = "2026-09-01T10:00:00.000Z"
+    expect(DiscoveryContactSchema.parse({ ...contact, bouncedAt: at }).bouncedAt).toBe(at)
+    expect(DiscoveryContactSchema.parse({ ...contact, bouncedAt: null }).bouncedAt).toBeNull()
+  })
+})
+
+describe("AnalyticsKpiSchema key and unit", () => {
+  const kpi = { label: "Resolved", num: 88.5, delta: "+1pt", dir: "up" }
+
+  it("still parses a payload without key or unit", () => {
+    expect(AnalyticsKpiSchema.safeParse(kpi).success).toBe(true)
+  })
+
+  it("parses a known key, an unknown future key and each unit", () => {
+    expect(AnalyticsKpiSchema.safeParse({ ...kpi, key: AnalyticsKpiKey.resolved, unit: "percent" }).success).toBe(true)
+    expect(AnalyticsKpiSchema.safeParse({ ...kpi, key: "a_later_kpi" }).success).toBe(true)
+    for (const unit of ["count", "percent", "hours"]) {
+      expect(AnalyticsKpiSchema.safeParse({ ...kpi, unit }).success).toBe(true)
+    }
+    expect(AnalyticsKpiSchema.safeParse({ ...kpi, unit: "days" }).success).toBe(false)
+    expect(AnalyticsKpiSchema.safeParse({ ...kpi, key: "" }).success).toBe(false)
+  })
+})
+
+describe("HomeSummaryResponseSchema degraded", () => {
+  const summary = {
+    discovery: { queue: 1, reportsWaiting: 2, overSla: 0 },
+    reports: { flagged: 0, inProgress: 1, completed: 2 },
+    events: { upcoming: 1, live: 0, attending: 3 },
+    mail: { unread: 0, needsAction: 0 },
+    users: { flagged: 0, highRisk: 0, suspended: 0 },
+    analytics: {
+      pinsThisMonth: 1,
+      resolvedPct: 50,
+      coveragePct: 10,
+      cleanups: 0,
+      eventsThisMonth: 0,
+      newUsers: 1,
+      pinsByWeek: [1],
+    },
+    livePins24h: 0,
+  }
+
+  it("still parses a payload without degraded", () => {
+    expect(HomeSummaryResponseSchema.safeParse(summary).success).toBe(true)
+  })
+
+  it("parses a list of degraded sections", () => {
+    expect(HomeSummaryResponseSchema.parse({ ...summary, degraded: ["mail"] }).degraded).toEqual(["mail"])
+    expect(HomeSummaryResponseSchema.safeParse({ ...summary, degraded: [1] }).success).toBe(false)
+  })
+})
+
+describe("CreateWalkupRegistrationRequestSchema idempotencyKey", () => {
+  const walkup = { id: UUID, name: "Rosa" }
+
+  it("still parses a request without idempotencyKey", () => {
+    expect(CreateWalkupRegistrationRequestSchema.safeParse(walkup).success).toBe(true)
+  })
+
+  it("applies the shared idempotency key bounds", () => {
+    const parse = (idempotencyKey: string) =>
+      CreateWalkupRegistrationRequestSchema.safeParse({ ...walkup, idempotencyKey }).success
+    expect(parse("a".repeat(8))).toBe(true)
+    expect(parse("a".repeat(128))).toBe(true)
+    expect(parse("a".repeat(7))).toBe(false)
+    expect(parse("a".repeat(129))).toBe(false)
+  })
+})
diff --git a/packages/shared/__tests__/host-dashboard-fakes.test.ts b/packages/shared/__tests__/host-dashboard-fakes.test.ts
index f376d17a..970ff214 100644
--- a/packages/shared/__tests__/host-dashboard-fakes.test.ts
+++ b/packages/shared/__tests__/host-dashboard-fakes.test.ts
@@ -16,6 +16,7 @@ import {
   ListMyHostedEventsResponseSchema,
 } from "../src/schemas/host/portfolio.js"
 import { eventPhase } from "../src/host/phase.js"
+import { hostCapabilities } from "../src/host/capabilities.js"
 
 
 const NOW = Date.parse("2026-09-11T17:00:00.000Z")
@@ -190,6 +191,15 @@ describe("fakeHostedEvents", () => {
     }
   })
 
+  it("grants each row exactly the capabilities the server derives from its event role", () => {
+    for (const when of ["upcoming", "past"] as const) {
+      for (const item of fakeHostedEvents(when, { now: NOW }).items) {
+        const expected = [...hostCapabilities({ eventRole: item.myRole ?? null, orgRole: null })]
+        expect(item.myCapabilities, `${when} ${item.myRole}`).toEqual(expected)
+      }
+    }
+  })
+
   it("stamps the org on every row when one is given", () => {
     const org = { orgId: "6f1a2c1e-4d9b-4c7a-8a2f-1b7c9d3e5a10", orgName: "Bayview Stewards" }
     for (const item of fakeHostedEvents("upcoming", { now: NOW, ...org }).items) {
diff --git a/packages/shared/__tests__/host-insights.test.ts b/packages/shared/__tests__/host-insights.test.ts
index 512f00b6..4fd0fe5a 100644
--- a/packages/shared/__tests__/host-insights.test.ts
+++ b/packages/shared/__tests__/host-insights.test.ts
@@ -5,7 +5,6 @@ import {
 } from "../src/schemas/common.js"
 import {
   ArrivalOffsetBucketSchema,
-  EventInsightsSchema,
   EventPhaseSchema,
   GetEventInsightsRequestSchema,
   GetEventInsightsResponseSchema,
@@ -98,7 +97,6 @@ describe("getEventInsights contract", () => {
     expect(parsed.arrivals).toEqual([])
     expect(parsed.phase).toBe("upcoming")
     expect(parsed.returning).toBeNull()
-    expect(EventInsightsSchema.parse(minimalInsights())).toEqual(parsed)
   })
 
   it("keeps every count a seat count and every seat count non-negative", () => {
diff --git a/packages/shared/__tests__/host-schemas.test.ts b/packages/shared/__tests__/host-schemas.test.ts
index 2ffdf7f8..52cc67a4 100644
--- a/packages/shared/__tests__/host-schemas.test.ts
+++ b/packages/shared/__tests__/host-schemas.test.ts
@@ -35,7 +35,7 @@ import {
   MAX_PORTFOLIO_TOP_VOLUNTEERS,
 } from "../src/schemas/host/analytics.js"
 import {
-  EventInsightsSchema,
+  GetEventInsightsResponseSchema,
   MAX_INSIGHTS_TOP_VOLUNTEERS,
 } from "../src/schemas/host/insights.js"
 import { NotificationTypeSchema } from "../src/schemas/notifications.js"
@@ -1174,14 +1174,14 @@ describe("hours on the host read models (DECISIONS §39)", () => {
   })
 
   it("defaults EventInsights.topVolunteers to [] and caps it", () => {
-    expect(EventInsightsSchema.parse(insights()).topVolunteers).toEqual([])
-    expect(EventInsightsSchema.parse(insights({ topVolunteers: [volunteer(1)] })).topVolunteers)
+    expect(GetEventInsightsResponseSchema.parse(insights()).topVolunteers).toEqual([])
+    expect(GetEventInsightsResponseSchema.parse(insights({ topVolunteers: [volunteer(1)] })).topVolunteers)
       .toHaveLength(1)
     expect(MAX_INSIGHTS_TOP_VOLUNTEERS).toBe(5)
     const overflow = Array.from({ length: MAX_INSIGHTS_TOP_VOLUNTEERS + 1 }, (_row, i) =>
       volunteer(i + 1),
     )
-    expect(EventInsightsSchema.safeParse(insights({ topVolunteers: overflow })).success).toBe(false)
+    expect(GetEventInsightsResponseSchema.safeParse(insights({ topVolunteers: overflow })).success).toBe(false)
   })
 
   it("keeps the org hours stats optional so a new org never reads zero", () => {
diff --git a/packages/shared/__tests__/schema-additions.test.ts b/packages/shared/__tests__/schema-additions.test.ts
index 1612a7af..89a456f2 100644
--- a/packages/shared/__tests__/schema-additions.test.ts
+++ b/packages/shared/__tests__/schema-additions.test.ts
@@ -7,7 +7,7 @@ import {
   REPORT_TYPE_VALUES,
   REPORT_TYPE_LABELS,
   REPORT_TYPE_TO_CATEGORY,
-  WEB_REPORT_TYPE_BY_ID,
+  WEB_REPORT_TYPES,
   LatLngFields,
   MediaPurposeSchema,
 } from "../src/schemas/common.js"
@@ -403,10 +403,11 @@ describe("canonical report type taxonomy", () => {
   })
 
   it("WEB_REPORT_TYPES categories agree with REPORT_TYPE_TO_CATEGORY for the overlapping ids", () => {
-    expect(WEB_REPORT_TYPE_BY_ID.infrastructure.category).toBe(REPORT_TYPE_TO_CATEGORY.infrastructure)
-    expect(WEB_REPORT_TYPE_BY_ID.vegetation.category).toBe(REPORT_TYPE_TO_CATEGORY.vegetation)
-    expect(WEB_REPORT_TYPE_BY_ID.infrastructure.category).toBe("water")
-    expect(WEB_REPORT_TYPE_BY_ID.vegetation.category).toBe("recycling")
+    const categoryOf = (id: string) => WEB_REPORT_TYPES.find((t) => t.id === id)?.category
+    expect(categoryOf("infrastructure")).toBe(REPORT_TYPE_TO_CATEGORY.infrastructure)
+    expect(categoryOf("vegetation")).toBe(REPORT_TYPE_TO_CATEGORY.vegetation)
+    expect(categoryOf("infrastructure")).toBe("water")
+    expect(categoryOf("vegetation")).toBe("recycling")
   })
 
   it("CreateReportRequest requires a type", () => {
diff --git a/packages/shared/__tests__/schemas.test.ts b/packages/shared/__tests__/schemas.test.ts
index 1653e75d..71a8d01a 100644
--- a/packages/shared/__tests__/schemas.test.ts
+++ b/packages/shared/__tests__/schemas.test.ts
@@ -7,8 +7,6 @@ import {
   PaginationQuerySchema,
   pageResponse,
   WEB_REPORT_TYPES,
-  WEB_REPORT_TYPE_BY_ID,
-  webReportTypeToCategory,
   PushPlatformSchema,
   OAuthProviderSchema,
   CleanupMemberRoleSchema,
@@ -96,11 +94,9 @@ describe("common enums + taxonomy", () => {
   it("WEB_REPORT_TYPES map to valid canonical categories", () => {
     for (const t of WEB_REPORT_TYPES) {
       expect(ReportCategorySchema.safeParse(t.category).success).toBe(true)
-      expect(t.gov.email).toMatch(/@/)
     }
-    expect(WEB_REPORT_TYPE_BY_ID.graffiti.category).toBe("graffiti")
-    expect(webReportTypeToCategory("dump")).toBe("trash")
-    expect(webReportTypeToCategory("unknown-id")).toBe("other")
+    expect(WEB_REPORT_TYPES.find((t) => t.id === "graffiti")?.category).toBe("graffiti")
+    expect(WEB_REPORT_TYPES.find((t) => t.id === "dump")?.category).toBe("trash")
   })
 })
 
diff --git a/packages/shared/__tests__/units-and-ids.test.ts b/packages/shared/__tests__/units-and-ids.test.ts
new file mode 100644
index 00000000..d96b5a20
--- /dev/null
+++ b/packages/shared/__tests__/units-and-ids.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest"
+import { IdSchema } from "../src/schemas/common.js"
+import * as units from "../src/time-units.js"
+import { stripTrailingSlashes } from "../src/url.js"
+import { isUuid } from "../src/uuid.js"
+
+describe("isUuid", () => {
+  const cases = [
+    "11111111-2222-4333-8444-555555555555",
+    "ABCDEF01-2345-6789-ABCD-EF0123456789",
+    "abcdef01-2345-6789-abcd-ef0123456789",
+    "00000000-0000-0000-0000-000000000000",
+    "",
+    "not-a-uuid",
+    "11111111-2222-4333-8444-55555555555",
+    "11111111-2222-4333-8444-5555555555555",
+    "11111111222243338444555555555555",
+    " 11111111-2222-4333-8444-555555555555",
+    "g1111111-2222-4333-8444-555555555555",
+  ]
+
+  it("accepts upper and lower case and rejects malformed values", () => {
+    expect(isUuid("11111111-2222-4333-8444-555555555555")).toBe(true)
+    expect(isUuid("ABCDEF01-2345-6789-ABCD-EF0123456789")).toBe(true)
+    expect(isUuid("11111111222243338444555555555555")).toBe(false)
+    expect(isUuid(" 11111111-2222-4333-8444-555555555555")).toBe(false)
+  })
+
+  it("agrees with IdSchema on every case", () => {
+    for (const value of cases) expect(isUuid(value)).toBe(IdSchema.safeParse(value).success)
+  })
+})
+
+describe("time units", () => {
+  it("holds the backend's values", () => {
+    expect({ ...units }).toEqual({
+      MS_PER_SECOND: 1000,
+      SECONDS_PER_MINUTE: 60,
+      MINUTES_PER_HOUR: 60,
+      SECONDS_PER_HOUR: 3600,
+      SECONDS_PER_DAY: 86_400,
+      MS_PER_MINUTE: 60_000,
+      MS_PER_HOUR: 3_600_000,
+      MS_PER_DAY: 86_400_000,
+      MS_PER_WEEK: 604_800_000,
+    })
+  })
+})
+
+describe("stripTrailingSlashes", () => {
+  it("removes every trailing slash and nothing else", () => {
+    expect(stripTrailingSlashes("https://api.example.org")).toBe("https://api.example.org")
+    expect(stripTrailingSlashes("https://api.example.org/")).toBe("https://api.example.org")
+    expect(stripTrailingSlashes("https://api.example.org/v1///")).toBe("https://api.example.org/v1")
+    expect(stripTrailingSlashes("/a//b/")).toBe("/a//b")
+    expect(stripTrailingSlashes("///")).toBe("")
+    expect(stripTrailingSlashes("")).toBe("")
+  })
+})
diff --git a/packages/shared/__tests__/versioning.test.ts b/packages/shared/__tests__/versioning.test.ts
index cab81197..887d4166 100644
--- a/packages/shared/__tests__/versioning.test.ts
+++ b/packages/shared/__tests__/versioning.test.ts
@@ -1,9 +1,5 @@
 import { describe, it, expect } from "vitest"
-import {
-  versionedPath,
-  API_VERSIONS,
-  LATEST_API_VERSION,
-} from "../src/client/versioning.js"
+import { versionedPath } from "../src/client/versioning.js"
 import { endpoints } from "../src/client/endpoints.js"
 
 describe("versionedPath", () => {
@@ -20,11 +16,6 @@ describe("versionedPath", () => {
       "/auth/google/start",
     )
   })
-
-  it("exposes the supported versions and the latest", () => {
-    expect(API_VERSIONS).toEqual(["v1"])
-    expect(LATEST_API_VERSION).toBe("v1")
-  })
 })
 
 describe("endpoint version invariants", () => {
diff --git a/packages/shared/__tests__/volunteer.test.ts b/packages/shared/__tests__/volunteer.test.ts
index b8061336..6b8b06a8 100644
--- a/packages/shared/__tests__/volunteer.test.ts
+++ b/packages/shared/__tests__/volunteer.test.ts
@@ -14,7 +14,6 @@ import {
   PublicVolunteerHoursResponseSchema,
   EventHoursQuerySchema,
   EventHoursResponseSchema,
-  REPORT_VOLUNTEER_HOURS,
   VOLUNTEER_HOURS_SOURCES,
   VolunteerHoursSourceSchema,
   MAX_EVENT_HOURS,
@@ -275,13 +274,8 @@ describe("volunteer DTOs", () => {
     expect(MAX_EVENT_HOURS).toBe(24)
   })
 
-  /**
-   * REPORT_VOLUNTEER_HOURS only documents what the historical `source='report'` rows are worth, so its
-   * value is frozen. `"report"` stays in VOLUNTEER_HOURS_SOURCES because old ledger rows, issued
-   * certificate snapshots and older servers still carry it.
-   */
-  it("the retired report auto-award constant is frozen, and its source stays parseable", () => {
-    expect(REPORT_VOLUNTEER_HOURS).toBe(0.1)
+  // Old ledger rows, issued certificate snapshots and older servers still carry "report".
+  it("the retired report source stays parseable", () => {
     expect(VOLUNTEER_HOURS_SOURCES).toContain("report")
     expect(VolunteerHoursSourceSchema.safeParse("report").success).toBe(true)
   })
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 844d33f9..51d9bbf6 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@civfix/shared",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "civfix shared contract package: zod schemas, domain types, vendor interfaces, in-memory fakes, design tokens, and a typed API client. Single source of truth for backend, web, and mobile.",
   "license": "AGPL-3.0-only",
   "private": false,
diff --git a/packages/shared/src/address.ts b/packages/shared/src/address.ts
index 757859c4..39111544 100644
--- a/packages/shared/src/address.ts
+++ b/packages/shared/src/address.ts
@@ -17,10 +17,6 @@ export function needsNearPrefix(precision: AddressPrecision | null | undefined):
   return precision === "landmark"
 }
 
-export function comparePrecision(a: AddressPrecision, b: AddressPrecision): number {
-  return ADDRESS_PRECISION_LADDER.indexOf(a) - ADDRESS_PRECISION_LADDER.indexOf(b)
-}
-
 export function isVerifiedEventAddress(
   addressSource: EventAddressSource | null | undefined,
   address: string | null | undefined,
diff --git a/packages/shared/src/client/client.ts b/packages/shared/src/client/client.ts
index a7ca06e3..ebba91ae 100644
--- a/packages/shared/src/client/client.ts
+++ b/packages/shared/src/client/client.ts
@@ -1,6 +1,6 @@
 import { z } from "zod"
 import { AppErrorSchema } from "../schemas/common.js"
-import { AppError, ErrorCode, isAppErrorLike } from "../types/errors.js"
+import { AppError, ErrorCode, isErrorCode } from "../types/errors.js"
 import {
   endpoints,
   type EndpointDef,
@@ -99,7 +99,7 @@ export async function parseError(res: Response, requestId?: string): Promise<App
   const parsed = AppErrorSchema.safeParse(payload)
   if (parsed.success) {
     const envelope = parsed.data
-    const code = isAppErrorLike(envelope) ? envelope.code : ErrorCode.INTERNAL
+    const code = isErrorCode(envelope.code) ? envelope.code : ErrorCode.INTERNAL
     return new AppError(code, envelope.message, {
       httpStatus: res.status,
       ...(envelope.fields !== undefined ? { fields: envelope.fields } : {}),
@@ -136,11 +136,6 @@ for (const name of Object.keys(endpoints) as EndpointName[]) {
 /** Endpoint names already warned about, so a mismatching server logs once instead of per call. */
 const warnedEndpoints = new Set<string>()
 
-/** Reset the once-per-endpoint warning memo. Exported for unit testing only. */
-export function resetResponseWarnings(): void {
-  warnedEndpoints.clear()
-}
-
 /**
  * Run a 2xx body through the endpoint's response schema so the DTOs' `.default()`s and `.catch()`es
  * actually apply on the read path; without this the inferred types lie whenever the deployed server is
@@ -265,8 +260,12 @@ export function createApiClient(opts: CreateApiClientOptions): ApiClient {
     let data: unknown
     try {
       data = await res.json()
-    } catch {
-      data = undefined
+    } catch (err) {
+      if (args.signal?.aborted) throw err
+      throw new AppError(ErrorCode.INTERNAL, `Response body for HTTP ${res.status} is not JSON`, {
+        ...(requestId !== undefined ? { requestId } : {}),
+        cause: err,
+      })
     }
     return parseResponse<Res>(endpoint, data)
   }
diff --git a/packages/shared/src/client/versioning.ts b/packages/shared/src/client/versioning.ts
index bf4c2ef9..afecfa3e 100644
--- a/packages/shared/src/client/versioning.ts
+++ b/packages/shared/src/client/versioning.ts
@@ -10,9 +10,6 @@
 export type ApiVersion = "v1"
 export type EndpointVersion = ApiVersion | "unversioned"
 
-export const API_VERSIONS = ["v1"] as const satisfies readonly ApiVersion[]
-export const LATEST_API_VERSION: ApiVersion = "v1"
-
 /** The ONE place version->path lives; the backend route() helper imports this too. */
 export function versionedPath(ep: { version: EndpointVersion; path: string }): string {
   return ep.version === "unversioned" ? ep.path : `/${ep.version}${ep.path}`
diff --git a/packages/shared/src/datetime.ts b/packages/shared/src/datetime.ts
index 49e6ca6e..61bf3a8a 100644
--- a/packages/shared/src/datetime.ts
+++ b/packages/shared/src/datetime.ts
@@ -1,4 +1,5 @@
 import { FORMAT_FALLBACK_LOCALE } from "./internal/format-locale.js"
+import { MS_PER_DAY, MS_PER_HOUR, MS_PER_MINUTE, MS_PER_WEEK } from "./time-units.js"
 
 /**
  * The compact "ago" label, shared so the server and both clients produce identical text.
@@ -49,12 +50,6 @@ export interface RelativeAgoOptions {
   absoluteFallback?: (d: Date) => string
 }
 
-const SECOND = 1000
-const MINUTE = 60 * SECOND
-const HOUR = 60 * MINUTE
-const DAY = 24 * HOUR
-const WEEK = 7 * DAY
-
 function toEpochMs(value: Date | string | number): number | null {
   if (value instanceof Date) {
     const t = value.getTime()
@@ -89,13 +84,13 @@ export function relativeAgo(
   const diff = nowMs - fromMs
 
   // Future timestamps and anything under a minute collapse to the just-now label.
-  if (diff < MINUTE) return justNow
-  if (diff < HOUR) return `${Math.floor(diff / MINUTE)}${minute}`
-  if (diff < DAY) return `${Math.floor(diff / HOUR)}${hour}`
-  if (diff < WEEK) return `${Math.floor(diff / DAY)}${day}`
+  if (diff < MS_PER_MINUTE) return justNow
+  if (diff < MS_PER_HOUR) return `${Math.floor(diff / MS_PER_MINUTE)}${minute}`
+  if (diff < MS_PER_DAY) return `${Math.floor(diff / MS_PER_HOUR)}${hour}`
+  if (diff < MS_PER_WEEK) return `${Math.floor(diff / MS_PER_DAY)}${day}`
 
   if (opts?.absoluteFallback) return opts.absoluteFallback(new Date(fromMs))
-  return `${Math.floor(diff / WEEK)}${week}`
+  return `${Math.floor(diff / MS_PER_WEEK)}${week}`
 }
 
 export interface WallClock {
diff --git a/packages/shared/src/fakes/chat-service.fake.ts b/packages/shared/src/fakes/chat-service.fake.ts
index 01315087..77c676ce 100644
--- a/packages/shared/src/fakes/chat-service.fake.ts
+++ b/packages/shared/src/fakes/chat-service.fake.ts
@@ -30,6 +30,11 @@ export class FakeChatService implements ChatService {
   private readonly rooms = new Map<string, Set<ChatConnection>>()
   private readonly messages = new Map<string, ChatMessageDTO[]>()
   private readonly nextId = makeIdFactory(42)
+  private readonly now: () => number
+
+  constructor(now: () => number = () => Date.now()) {
+    this.now = now
+  }
 
   joinRoom(cleanupId: string, conn: ChatConnection, _userId: string): Promise<void> {
     let room = this.rooms.get(cleanupId)
@@ -86,7 +91,7 @@ export class FakeChatService implements ChatService {
       // The fake has no media pipeline, so a media send over the all-fakes dev path echoes back with no
       // attachments.
       attachments: null,
-      createdAt: new Date().toISOString(),
+      createdAt: new Date(this.now()).toISOString(),
       editedAt: null,
       reactions: [],
       mentions: [],
diff --git a/packages/shared/src/fakes/host-dashboard.fake.ts b/packages/shared/src/fakes/host-dashboard.fake.ts
index 92ffe0a4..9c82eda6 100644
--- a/packages/shared/src/fakes/host-dashboard.fake.ts
+++ b/packages/shared/src/fakes/host-dashboard.fake.ts
@@ -1,4 +1,6 @@
 import { avatarGradient } from "../avatar.js"
+import { hostCapabilities } from "../host/capabilities.js"
+import type { CleanupMemberRole, HostCapability } from "../schemas/common.js"
 import { ANALYTICS_SUPPRESSION_K } from "../schemas/host/suppression.js"
 import type {
   BreakdownRow,
@@ -23,18 +25,14 @@ import type {
 } from "../schemas/host/portfolio.js"
 import type { LeaderboardEntryDTO } from "../schemas/entities.js"
 import { makeIdFactory } from "./ids.js"
-
-
-const MINUTE_MS = 60_000
-const HOUR_MS = 3_600_000
-const DAY_MS = 86_400_000
+import { MS_PER_DAY, MS_PER_HOUR, MS_PER_MINUTE } from "../time-units.js"
 
 const FAKE_CAPACITY = 60
 const FAKE_REGISTERED = 42
 const FAKE_WAITLISTED = 7
 const FAKE_CANCELLED_SEATS = 5
 const FAKE_TREND_DAYS = 14
-const FAKE_EVENT_DURATION_MS = 4 * HOUR_MS
+const FAKE_EVENT_DURATION_MS = 4 * MS_PER_HOUR
 const FAKE_TIMEZONE = "America/Los_Angeles"
 
 export interface FakeEventInsightsOptions {
@@ -142,7 +140,7 @@ function phaseProfile(phase: EventPhase, now: number): PhaseProfile {
   if (phase === "live") {
     return {
       status: "active",
-      startsAt: now - 45 * MINUTE_MS,
+      startsAt: now - 45 * MS_PER_MINUTE,
       completedAt: null,
       checkedIn: 27,
       noShow: 0,
@@ -151,7 +149,7 @@ function phaseProfile(phase: EventPhase, now: number): PhaseProfile {
     }
   }
   if (phase === "ended") {
-    const startsAt = now - 9 * DAY_MS
+    const startsAt = now - 9 * MS_PER_DAY
     return {
       status: "done",
       startsAt,
@@ -165,7 +163,7 @@ function phaseProfile(phase: EventPhase, now: number): PhaseProfile {
   if (phase === "cancelled") {
     return {
       status: "cancelled",
-      startsAt: now + 5 * DAY_MS,
+      startsAt: now + 5 * MS_PER_DAY,
       completedAt: null,
       checkedIn: 0,
       noShow: 0,
@@ -175,7 +173,7 @@ function phaseProfile(phase: EventPhase, now: number): PhaseProfile {
   }
   return {
     status: "upcoming",
-    startsAt: now + 3 * DAY_MS,
+    startsAt: now + 3 * MS_PER_DAY,
     completedAt: null,
     checkedIn: 0,
     noShow: 0,
@@ -225,9 +223,9 @@ function fakeBroadcasts(
   phase: EventPhase,
   startsAt: number,
 ): InsightsBroadcast[] {
-  const confirmationAt = startsAt - 12 * DAY_MS
-  const reminderAt = startsAt - 2 * DAY_MS
-  const recapAt = startsAt + FAKE_EVENT_DURATION_MS + HOUR_MS
+  const confirmationAt = startsAt - 12 * MS_PER_DAY
+  const reminderAt = startsAt - 2 * MS_PER_DAY
+  const recapAt = startsAt + FAKE_EVENT_DURATION_MS + MS_PER_HOUR
   const pending = phase === "upcoming" || phase === "cancelled"
   return [
     {
@@ -276,7 +274,7 @@ function fakeTrend(
 ): SeatPoint[] {
   const points = cumulative(registered, FAKE_TREND_DAYS, rng)
   return points.map((seats, i) => ({
-    day: dayKey(lastDayMs - (FAKE_TREND_DAYS - 1 - i) * DAY_MS),
+    day: dayKey(lastDayMs - (FAKE_TREND_DAYS - 1 - i) * MS_PER_DAY),
     seats,
   }))
 }
@@ -302,7 +300,7 @@ export function fakeEventInsights(
       startsAt: new Date(profile.startsAt).toISOString(),
       endsAt: new Date(endsAt).toISOString(),
       completedAt: profile.completedAt === null ? null : new Date(profile.completedAt).toISOString(),
-      registrationClosesAt: new Date(profile.startsAt - 12 * HOUR_MS).toISOString(),
+      registrationClosesAt: new Date(profile.startsAt - 12 * MS_PER_HOUR).toISOString(),
       timezone: options.timezone ?? FAKE_TIMEZONE,
     },
     seats: {
@@ -357,7 +355,7 @@ export function fakeHostedEventsAnalytics(
   const series: SeriesPoint[] = []
   for (let i = points - 1; i >= 0; i -= 1) {
     series.push({
-      day: dayKey(now - i * DAY_MS),
+      day: dayKey(now - i * MS_PER_DAY),
       value: Math.round(4 + rng() * 22),
       suppressed: false,
     })
@@ -412,6 +410,10 @@ export function fakeHostPortfolioKpis(): HostPortfolioKpis {
   }
 }
 
+function eventRoleCapabilities(eventRole: CleanupMemberRole): HostCapability[] {
+  return [...hostCapabilities({ eventRole, orgRole: null })]
+}
+
 export function fakeHostedEvents(
   when: "upcoming" | "past" = "upcoming",
   options: FakeHostedEventsOptions,
@@ -425,8 +427,8 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[0],
-      startsAt: new Date(now + 3 * DAY_MS).toISOString(),
-      endsAt: new Date(now + 3 * DAY_MS + FAKE_EVENT_DURATION_MS).toISOString(),
+      startsAt: new Date(now + 3 * MS_PER_DAY).toISOString(),
+      endsAt: new Date(now + 3 * MS_PER_DAY + FAKE_EVENT_DURATION_MS).toISOString(),
       timezone: FAKE_TIMEZONE,
       status: "upcoming",
       visibility: "public",
@@ -436,17 +438,7 @@ export function fakeHostedEvents(
       checkedInCount: 0,
       waitlistCount: 7,
       myRole: "organizer",
-      myCapabilities: [
-        "view_event_private",
-        "view_roster",
-        "view_analytics",
-        "check_in",
-        "manage_event",
-        "manage_tickets",
-        "manage_team",
-        "broadcast",
-        "export",
-      ],
+      myCapabilities: eventRoleCapabilities("organizer"),
       orgId,
       orgName,
       pageSlug: null,
@@ -455,8 +447,8 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[3],
-      startsAt: new Date(now + 11 * DAY_MS).toISOString(),
-      endsAt: new Date(now + 11 * DAY_MS + FAKE_EVENT_DURATION_MS).toISOString(),
+      startsAt: new Date(now + 11 * MS_PER_DAY).toISOString(),
+      endsAt: new Date(now + 11 * MS_PER_DAY + FAKE_EVENT_DURATION_MS).toISOString(),
       timezone: FAKE_TIMEZONE,
       status: "upcoming",
       visibility: "unlisted",
@@ -466,7 +458,7 @@ export function fakeHostedEvents(
       checkedInCount: 0,
       waitlistCount: 0,
       myRole: "cohost",
-      myCapabilities: ["view_event_private", "view_roster", "check_in", "broadcast"],
+      myCapabilities: eventRoleCapabilities("cohost"),
       orgId,
       orgName,
       pageSlug: null,
@@ -475,7 +467,7 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[5],
-      startsAt: new Date(now + 24 * DAY_MS).toISOString(),
+      startsAt: new Date(now + 24 * MS_PER_DAY).toISOString(),
       endsAt: null,
       timezone: FAKE_TIMEZONE,
       status: "upcoming",
@@ -486,7 +478,7 @@ export function fakeHostedEvents(
       checkedInCount: 0,
       waitlistCount: 0,
       myRole: "coordinator",
-      myCapabilities: ["view_event_private", "view_roster", "view_analytics"],
+      myCapabilities: eventRoleCapabilities("coordinator"),
       orgId,
       orgName,
       pageSlug: null,
@@ -497,8 +489,8 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[1],
-      startsAt: new Date(now - 9 * DAY_MS).toISOString(),
-      endsAt: new Date(now - 9 * DAY_MS + FAKE_EVENT_DURATION_MS).toISOString(),
+      startsAt: new Date(now - 9 * MS_PER_DAY).toISOString(),
+      endsAt: new Date(now - 9 * MS_PER_DAY + FAKE_EVENT_DURATION_MS).toISOString(),
       timezone: FAKE_TIMEZONE,
       status: "done",
       visibility: "public",
@@ -509,17 +501,7 @@ export function fakeHostedEvents(
       waitlistCount: 7,
       hoursCredited: 114.5,
       myRole: "organizer",
-      myCapabilities: [
-        "view_event_private",
-        "view_roster",
-        "view_analytics",
-        "check_in",
-        "manage_event",
-        "manage_tickets",
-        "manage_team",
-        "broadcast",
-        "export",
-      ],
+      myCapabilities: eventRoleCapabilities("organizer"),
       orgId,
       orgName,
       pageSlug: null,
@@ -528,8 +510,8 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[2],
-      startsAt: new Date(now - 26 * DAY_MS).toISOString(),
-      endsAt: new Date(now - 26 * DAY_MS + FAKE_EVENT_DURATION_MS).toISOString(),
+      startsAt: new Date(now - 26 * MS_PER_DAY).toISOString(),
+      endsAt: new Date(now - 26 * MS_PER_DAY + FAKE_EVENT_DURATION_MS).toISOString(),
       timezone: FAKE_TIMEZONE,
       status: "done",
       visibility: "public",
@@ -540,14 +522,7 @@ export function fakeHostedEvents(
       waitlistCount: 3,
       hoursCredited: 0,
       myRole: "organizer",
-      myCapabilities: [
-        "view_event_private",
-        "view_roster",
-        "view_analytics",
-        "check_in",
-        "manage_event",
-        "broadcast",
-      ],
+      myCapabilities: eventRoleCapabilities("organizer"),
       orgId,
       orgName,
       pageSlug: null,
@@ -556,7 +531,7 @@ export function fakeHostedEvents(
     {
       id: nextId(),
       title: PORTFOLIO_EVENT_TITLES[4],
-      startsAt: new Date(now - 41 * DAY_MS).toISOString(),
+      startsAt: new Date(now - 41 * MS_PER_DAY).toISOString(),
       endsAt: null,
       timezone: FAKE_TIMEZONE,
       status: "cancelled",
@@ -567,7 +542,7 @@ export function fakeHostedEvents(
       checkedInCount: 0,
       waitlistCount: 0,
       myRole: "organizer",
-      myCapabilities: ["view_event_private", "view_roster", "view_analytics", "manage_event"],
+      myCapabilities: eventRoleCapabilities("organizer"),
       orgId,
       orgName,
       pageSlug: null,
diff --git a/packages/shared/src/fakes/inbound-mail.fake.ts b/packages/shared/src/fakes/inbound-mail.fake.ts
index 19cc294c..b7635d79 100644
--- a/packages/shared/src/fakes/inbound-mail.fake.ts
+++ b/packages/shared/src/fakes/inbound-mail.fake.ts
@@ -19,6 +19,8 @@ const DEFAULT_REPLY_DOMAIN = "civfix.org"
  */
 const REPLY_ADDRESS_RE = /^(?:reply|report|event)[-+]([^@\s]+)@([^@\s]+)$/
 
+const REPLY_ADDRESS_SCAN_RE = /(?<![^\s<,;:"])(?:reply|report|event)[-+][^@\s<>,;"]+@[^@\s<>,;"]+/gi
+
 /**
  * In-memory InboundMail. Parses a tiny subset of RFC822: leading "Header: value" lines until a
  * blank line, then the remainder is the text body. Deterministic and dependency-free.
@@ -73,19 +75,16 @@ export class FakeInboundMail implements InboundMail {
   }
 
   /**
-   * Extract a thread token from an X-Thread-Token header or a typed reply address on OUR reply domain.
-   * The address is anchored + domain-checked and the token shape-validated exactly like the real
-   * CfInboundMail adapter, so a city's own `report-*@city.gov` alias, a foreign CC, or a junk value
-   * cannot create stray threads.
+   * Mirrors the real CfInboundMail adapter: a typed reply address on OUR reply domain, read from To and
+   * then scanned out of the raw Cc header, lowercased before matching. An X-Thread-Token header is ignored
+   * because any sender can set it, which would let a stranger pick the thread. Anchoring, the domain check
+   * and the token shape keep a city's own `report-*@city.gov` alias or a junk value from creating threads.
    */
   extractThreadToken(mail: ParsedMail): string | null {
-    const headerToken = mail.headers["x-thread-token"]
-    if (headerToken && THREAD_TOKEN_RE.test(headerToken)) return headerToken
-    for (const addr of mail.to) {
-      const m = addr.address.match(REPLY_ADDRESS_RE)
-      if (m && m[1] && m[2] && m[2].toLowerCase() === this.replyDomain) {
-        if (THREAD_TOKEN_RE.test(m[1])) return m[1]
-      }
+    const ccAddresses = (mail.headers["cc"] ?? "").match(REPLY_ADDRESS_SCAN_RE) ?? []
+    for (const address of [...mail.to.map((addr) => addr.address), ...ccAddresses]) {
+      const match = address.toLowerCase().match(REPLY_ADDRESS_RE)
+      if (match?.[1] && match[2] === this.replyDomain && THREAD_TOKEN_RE.test(match[1])) return match[1]
     }
     return null
   }
diff --git a/packages/shared/src/geocode.ts b/packages/shared/src/geocode.ts
index ec3f811d..b81985a7 100644
--- a/packages/shared/src/geocode.ts
+++ b/packages/shared/src/geocode.ts
@@ -69,6 +69,12 @@ export interface SuggestOptions {
    * results. Ignored by Photon (which has no equivalent filter).
    */
   country?: string | null
+  /**
+   * Told about a provider failure that suggestAddresses degrades past (Mapbox falling back to Photon,
+   * Photon resolving []), so a server caller can log an outage the result alone cannot show. Never
+   * called for the caller's own abort.
+   */
+  onError?: (error: unknown, provider: "mapbox" | "photon") => void
 }
 
 /** Languages Photon actually serves; anything else is requested as English. */
@@ -104,11 +110,15 @@ export function parseLatLng(input: string): LatLng | null {
   return { lat, lng }
 }
 
+// English fallbacks: the wire suggestion has no locale-free field for these, so the UI cannot translate them.
+const EXACT_COORDINATES_LABEL = "Exact coordinates"
+const UNKNOWN_PLACE_LABEL = "Unknown place"
+
 function coordSuggestion(coord: LatLng): GeoSuggestion {
   return {
     id: `coordinate:${coord.lat},${coord.lng}`,
     label: coordsLabel(coord),
-    secondary: "Exact coordinates",
+    secondary: EXACT_COORDINATES_LABEL,
     lat: coord.lat,
     lng: coord.lng,
     source: "coordinate",
@@ -136,7 +146,7 @@ interface PhotonFeature {
 function photonLabel(p: PhotonProperties): string {
   if (p.name) return p.name
   const street = [p.housenumber, p.street].filter(Boolean).join(" ")
-  return street || p.city || p.state || "Unknown place"
+  return street || p.city || p.state || UNKNOWN_PLACE_LABEL
 }
 function photonSecondary(p: PhotonProperties, label: string): string | undefined {
   const parts = [p.city, p.state, p.country].filter((v): v is string => !!v && v !== label)
@@ -211,7 +221,7 @@ interface MapboxV6Feature {
 }
 
 function mapboxLabel(p: MapboxV6Properties): string {
-  return p.name || p.full_address || p.place_formatted || "Unknown place"
+  return p.name || p.full_address || p.place_formatted || UNKNOWN_PLACE_LABEL
 }
 function mapboxSecondary(p: MapboxV6Properties, label: string): string | undefined {
   if (p.place_formatted && p.place_formatted !== label) return p.place_formatted
@@ -280,7 +290,7 @@ function isAbort(err: unknown, signal?: AbortSignal): boolean {
 /**
  * Address autocomplete: a pasted coordinate short-circuits; then Mapbox when `opts.mapboxToken` is set
  * (falling back to Photon when Mapbox throws OR returns nothing); else Photon. Provider errors degrade
- * to [], but an abort rejects.
+ * to [] and are reported through `opts.onError`, but an abort rejects.
  */
 export async function suggestAddresses(query: string, opts: SuggestOptions = {}): Promise<GeoSuggestion[]> {
   const q = query.trim()
@@ -297,38 +307,14 @@ export async function suggestAddresses(query: string, opts: SuggestOptions = {})
       // An abort is the caller cancelling a stale keystroke: reject so the old request cannot resolve []
       // over the newer one's suggestions, and skip a Photon request nobody is waiting on.
       if (isAbort(err, opts.signal)) throw err
-      // Mapbox unavailable → fall through to Photon.
+      opts.onError?.(err, "mapbox")
     }
   }
   try {
     return await photonSuggest(q, opts)
   } catch (err) {
     if (isAbort(err, opts.signal)) throw err
+    opts.onError?.(err, "photon")
     return []
   }
 }
-
-const GEOJS_URL = "https://get.geojs.io/v1/ip/geo.json"
-
-/**
- * Best-effort IP geolocation (no permission prompt) via GeoJS - a free, CORS-enabled, key-less HTTPS
- * endpoint. Returns null on any failure so callers can fall back to a map center. Used as the proximity
- * source when device location sharing is denied or unavailable.
- *
- * @deprecated since 0.47.0. A third-party data flow with no consumer-plane callers left. Use
- * `GET /geo/approximate` (`getApproximateLocation`, DECISIONS #45).
- */
-export async function ipLocate(signal?: AbortSignal): Promise<LatLng | null> {
-  try {
-    const res = await fetch(GEOJS_URL, { signal, headers: { Accept: "application/json" } })
-    if (!res.ok) return null
-    const data = (await res.json()) as { latitude?: string | number; longitude?: string | number }
-    const lat = Number(data.latitude)
-    const lng = Number(data.longitude)
-    if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null
-    if (lat < -90 || lat > 90 || lng < -180 || lng > 180) return null
-    return { lat, lng }
-  } catch {
-    return null
-  }
-}
diff --git a/packages/shared/src/host/__tests__/derive.test.ts b/packages/shared/src/host/__tests__/derive.test.ts
index db4c824e..aa483d16 100644
--- a/packages/shared/src/host/__tests__/derive.test.ts
+++ b/packages/shared/src/host/__tests__/derive.test.ts
@@ -5,15 +5,30 @@ import {
   arrivalsCurve,
   bestDayTime,
   breakdown,
-  cumulativeSeries,
   dailySeries,
   enumerateDays,
   funnel,
-  hourlySeries,
-  registrationSeries,
-  repeatAttendanceRate,
+  type DayCount,
+  type DayRange,
+  type DerivedSeriesPanel,
+  type SuppressOptions,
 } from "../derive.js"
 
+// The cumulative panel as the backend publishes it: the closure's running totals, and the total only
+// when the closure marks it publishable.
+function cumulativeView(
+  points: readonly DayCount[],
+  range: DayRange,
+  options: SuppressOptions = {},
+): DerivedSeriesPanel {
+  const closure = seriesClosure(points, range, options)
+  return {
+    panelSuppressed: closure.panelSuppressed,
+    total: closure.totalPublishable ? closure.total : null,
+    points: closure.cumulative,
+  }
+}
+
 describe("enumerateDays", () => {
   it("gap-fills an inclusive range across a month boundary", () => {
     expect(enumerateDays({ from: "2026-01-30", to: "2026-02-02" })).toEqual([
@@ -92,30 +107,6 @@ describe("dailySeries", () => {
     expect(panel.total).toBe(7)
     expect(panel.points[0]?.value).toBe(7)
   })
-
-  it("is aliased as registrationSeries and is deterministic", () => {
-    const points = [{ day: "2026-05-04", count: 8 }]
-    expect(registrationSeries(points, range)).toEqual(dailySeries(points, range))
-  })
-})
-
-describe("hourlySeries", () => {
-  it("always returns 24 gap-filled buckets", () => {
-    const panel = hourlySeries([
-      { hour: 9, count: 4 },
-      { hour: 9, count: 3 },
-      { hour: 30, count: 99 },
-    ])
-    expect(panel.points).toHaveLength(24)
-    expect(panel.points[9]?.value).toBe(7)
-    expect(panel.total).toBe(7)
-  })
-
-  it("suppresses the panel under k", () => {
-    const panel = hourlySeries([{ hour: 1, count: 2 }])
-    expect(panel.panelSuppressed).toBe(true)
-    expect(panel.points.every((p) => p.value === null)).toBe(true)
-  })
 })
 
 describe("breakdown", () => {
@@ -268,18 +259,11 @@ describe("bestDayTime", () => {
   })
 })
 
-describe("repeatAttendanceRate", () => {
-  it("is a rate and never a list", () => {
-    expect(repeatAttendanceRate(3, 12)).toEqual({ suppressed: false, value: 0.25 })
-    expect(repeatAttendanceRate(1, 4)).toEqual({ suppressed: true, value: null })
-  })
-})
-
-describe("cumulativeSeries", () => {
+describe("seriesClosure cumulative view", () => {
   const range = { from: "2026-05-01", to: "2026-05-05" }
 
   it("publishes no step at all once the hidden tail could be pinned by the total", () => {
-    const panel = cumulativeSeries(
+    const panel = cumulativeView(
       [
         { day: "2026-05-01", count: 6 },
         { day: "2026-05-02", count: 2 },
@@ -298,7 +282,7 @@ describe("cumulativeSeries", () => {
   })
 
   it("waits for the hidden group to reach a revealable band, then shows the total again", () => {
-    const panel = cumulativeSeries(
+    const panel = cumulativeView(
       [
         { day: "2026-05-01", count: 10 },
         { day: "2026-05-02", count: 3 },
@@ -312,19 +296,19 @@ describe("cumulativeSeries", () => {
   })
 
   it("suppresses the whole panel below k", () => {
-    const panel = cumulativeSeries([{ day: "2026-05-02", count: 3 }], range)
+    const panel = cumulativeView([{ day: "2026-05-02", count: 3 }], range)
     expect(panel.panelSuppressed).toBe(true)
     expect(panel.total).toBeNull()
     expect(panel.points.every((p) => p.value === null && p.suppressed)).toBe(true)
   })
 
   it("shows a leading run of zeroes without disclosing anything", () => {
-    const panel = cumulativeSeries([{ day: "2026-05-05", count: 9 }], range)
+    const panel = cumulativeView([{ day: "2026-05-05", count: 9 }], range)
     expect(panel.points.map((p) => p.value)).toEqual([0, 0, 0, 0, 9])
   })
 
   it("ignores days outside the range", () => {
-    const panel = cumulativeSeries(
+    const panel = cumulativeView(
       [
         { day: "2026-04-30", count: 100 },
         { day: "2026-05-02", count: 8 },
@@ -347,7 +331,7 @@ describe("complementary suppression across the daily, cumulative and total views
 
   it("leaks the sub-k day through NO combination of the three published views", () => {
     const daily = dailySeries(points, range, { suppressPoints: true })
-    const cumulative = cumulativeSeries(points, range)
+    const cumulative = cumulativeView(points, range)
 
     expect(daily.points.map((p) => p.value)).toEqual([6, null, 7])
     expect(daily.total).toBeNull()
@@ -376,7 +360,7 @@ describe("complementary suppression across the daily, cumulative and total views
       { day: "2026-05-03", count: 7 },
     ]
     const daily = dailySeries(open, range, { suppressPoints: true })
-    const cumulative = cumulativeSeries(open, range)
+    const cumulative = cumulativeView(open, range)
     expect(daily.points.map((p) => p.value)).toEqual([6, 5, 7])
     expect(daily.total).toBe(18)
     expect(cumulative.points.map((p) => p.value)).toEqual([6, 11, 18])
@@ -404,7 +388,7 @@ function publishedOf(values: readonly number[], k = K) {
   const range = rangeOf(values.length)
   const points = countsOf(values)
   const daily = dailySeries(points, range, { suppressPoints: true, k })
-  const cumulative = cumulativeSeries(points, range, { k })
+  const cumulative = cumulativeView(points, range, { k })
   return {
     daily: daily.points.map((p) => p.value),
     dailyTotal: daily.total,
diff --git a/packages/shared/src/host/__tests__/render.test.ts b/packages/shared/src/host/__tests__/render.test.ts
index df9d39ed..8bc91fc6 100644
--- a/packages/shared/src/host/__tests__/render.test.ts
+++ b/packages/shared/src/host/__tests__/render.test.ts
@@ -109,6 +109,46 @@ describe("assertSafeBroadcastLinks", () => {
     expect(inspectBroadcastLinks("data:text/html;base64,PHNjcmlwdD4=")[0]?.kind).toBe("insecure_scheme")
   })
 
+  it("still flags every dangerous scheme wherever it starts a token and runs into a payload", () => {
+    const schemes = ["javascript", "data", "vbscript", "file", "blob", "jar", "about"]
+    const openers = ["", " ", "\t", "\n", "(", "[", "{", "<", '"', "'", "`", "=", ",", ";", "!", "*", "|", ">", "](", "](<"]
+    const payloads = ["alert(1)", "//evil.example/x", "text/html;base64,PHNjcmlwdD4=", "%0aalert(1)", "blank"]
+    for (const scheme of schemes) {
+      for (const cased of [scheme, scheme.toUpperCase(), scheme[0]!.toUpperCase() + scheme.slice(1)]) {
+        for (const opener of openers) {
+          for (const payload of payloads) {
+            const text = `Tap ${opener}${cased}:${payload}`
+            const flagged = inspectBroadcastLinks(text).some(
+              (i) => i.kind === "insecure_scheme" && i.scheme === scheme,
+            )
+            expect(flagged, text).toBe(true)
+          }
+        }
+      }
+    }
+  })
+
+  it("still flags an executable scheme with whitespace before its payload", () => {
+    for (const text of ["javascript: alert(1)", "javascript:\talert(1)", "see data: text/html,x", "Waiver file: here"]) {
+      expect(inspectBroadcastLinks(text).length, text).toBeGreaterThan(0)
+    }
+  })
+
+  it("does not flag about as prose or a scheme word inside an https path", () => {
+    const prose = [
+      "Questions about: parking.",
+      "Topic: about:",
+      "https://example.org/data:foo",
+      "https://example.org/a.javascript:x",
+      "https://example.org/a-blob:x",
+      "https://example.org/a:jar:x",
+    ]
+    for (const text of prose) {
+      expect(inspectBroadcastLinks(text), text).toEqual([])
+    }
+    expect(inspectBroadcastLinks("Questions about: parking. More about: parking")).toEqual([])
+  })
+
   it("rejects scheme-relative links", () => {
     expect(inspectBroadcastLinks("go to //evil.example/x")[0]?.kind).toBe("scheme_relative")
   })
diff --git a/packages/shared/src/host/derive.ts b/packages/shared/src/host/derive.ts
index efb139e9..bb5c3759 100644
--- a/packages/shared/src/host/derive.ts
+++ b/packages/shared/src/host/derive.ts
@@ -1,6 +1,6 @@
 import { intOr } from "../internal/numbers.js"
+import { MS_PER_DAY } from "../time-units.js"
 import { K_SUPPRESS, normalizeK, roundRate, safeCount } from "./counts.js"
-import { suppressRate, type SuppressedRatio } from "./suppress.js"
 
 export const MAX_SERIES_DAYS = 400
 export const MAX_ARRIVAL_BUCKETS = 200
@@ -9,7 +9,6 @@ const DEFAULT_ARRIVAL_BUCKET_MINUTES = 15
 const DEFAULT_ARRIVAL_FROM_MINUTES = -120
 const DEFAULT_ARRIVAL_TO_MINUTES = 240
 
-const DAY_MS = 86400000
 const DAY_RE = /^\d{4}-\d{2}-\d{2}$/
 
 export interface DayRange {
@@ -143,10 +142,6 @@ function utcMsToDay(ms: number): string {
   return `${year}-${month}-${date}`
 }
 
-export function isCalendarDay(day: string): boolean {
-  return Number.isFinite(dayToUtcMs(day))
-}
-
 export function enumerateDays(range: DayRange): string[] {
   const from = dayToUtcMs(range.from)
   const to = dayToUtcMs(range.to)
@@ -154,12 +149,12 @@ export function enumerateDays(range: DayRange): string[] {
     throw new RangeError("enumerateDays expects YYYY-MM-DD calendar days")
   }
   if (to < from) throw new RangeError("enumerateDays expects range.from <= range.to")
-  const span = Math.round((to - from) / DAY_MS) + 1
+  const span = Math.round((to - from) / MS_PER_DAY) + 1
   if (span > MAX_SERIES_DAYS) {
     throw new RangeError(`enumerateDays refuses an unbounded range (${span} days > ${MAX_SERIES_DAYS})`)
   }
   const days: string[] = []
-  for (let i = 0; i < span; i++) days.push(utcMsToDay(from + i * DAY_MS))
+  for (let i = 0; i < span; i++) days.push(utcMsToDay(from + i * MS_PER_DAY))
   return days
 }
 
@@ -304,36 +299,6 @@ export function dailySeries(
   }
 }
 
-export function registrationSeries(
-  points: readonly DayCount[],
-  range: DayRange,
-  options: SuppressOptions = {},
-): DerivedSeriesPanel {
-  return dailySeries(points, range, options)
-}
-
-export function hourlySeries(points: readonly HourCount[], options: SuppressOptions = {}): DerivedHourPanel {
-  const k = normalizeK(options.k)
-  const byHour = new Array<number>(24).fill(0)
-  for (const point of points) {
-    if (!Number.isInteger(point.hour) || point.hour < 0 || point.hour > 23) continue
-    byHour[point.hour] = (byHour[point.hour] ?? 0) + safeCount(point.count)
-  }
-  const total = byHour.reduce((sum, value) => sum + value, 0)
-  const panelSuppressed = total < k
-  const suppressPoints = options.suppressPoints === true
-  const hidden = suppressPoints ? hiddenGroupOf(byHour, k) : { count: 0, mass: 0 }
-  const totalPublishable = !panelSuppressed && groupRevealable(hidden.count, hidden.mass, k)
-  return {
-    panelSuppressed,
-    total: totalPublishable ? total : null,
-    points: byHour.map((value, hour) => {
-      const suppressed = panelSuppressed || (suppressPoints && value < k)
-      return { hour, value: suppressed ? null : value, suppressed }
-    }),
-  }
-}
-
 export function breakdownClosure(
   rows: readonly KeyCount[],
   options: BreakdownOptions = {},
@@ -455,24 +420,3 @@ export function bestDayTime(cells: readonly DayTimeCount[], k: number = K_SUPPRE
   if (best === null || best.value < threshold) return null
   return best
 }
-
-export function repeatAttendanceRate(
-  repeatAttendees: number,
-  totalAttendees: number,
-  k: number = K_SUPPRESS,
-): SuppressedRatio {
-  return suppressRate(repeatAttendees, totalAttendees, k)
-}
-
-export function cumulativeSeries(
-  points: readonly DayCount[],
-  range: DayRange,
-  options: SuppressOptions = {},
-): DerivedSeriesPanel {
-  const closure = seriesClosure(points, range, options)
-  return {
-    panelSuppressed: closure.panelSuppressed,
-    total: closure.totalPublishable ? closure.total : null,
-    points: closure.cumulative,
-  }
-}
diff --git a/packages/shared/src/host/index.ts b/packages/shared/src/host/index.ts
index 14ed1be2..f9ff64fb 100644
--- a/packages/shared/src/host/index.ts
+++ b/packages/shared/src/host/index.ts
@@ -11,4 +11,3 @@ export * from "./checkin-result.js"
 export * from "./roster-seats.js"
 export * from "./registration.js"
 export * from "./day-label.js"
-export * from "../markdown/safe-url.js"
diff --git a/packages/shared/src/host/phase.ts b/packages/shared/src/host/phase.ts
index b51992e5..ac8daa55 100644
--- a/packages/shared/src/host/phase.ts
+++ b/packages/shared/src/host/phase.ts
@@ -1,13 +1,11 @@
 import type { CleanupStatus } from "../schemas/entities.js"
 import type { EventPhase } from "../schemas/host/insights.js"
 import { DEFAULT_EVENT_DURATION_MINUTES } from "../schemas/event-duration.js"
+import { MS_PER_HOUR, MS_PER_MINUTE } from "../time-units.js"
 
-const MINUTE_MS = 60_000
-const HOUR_MS = 60 * MINUTE_MS
-
-export const LIVE_LEAD_MS = 2 * HOUR_MS
-export const LIVE_TAIL_MS = 2 * HOUR_MS
-export const DEFAULT_EVENT_DURATION_MS = DEFAULT_EVENT_DURATION_MINUTES * MINUTE_MS
+export const LIVE_LEAD_MS = 2 * MS_PER_HOUR
+export const LIVE_TAIL_MS = 2 * MS_PER_HOUR
+export const DEFAULT_EVENT_DURATION_MS = DEFAULT_EVENT_DURATION_MINUTES * MS_PER_MINUTE
 export const DEFAULT_DURATION_MS = DEFAULT_EVENT_DURATION_MS
 
 export interface EventWindowLike {
diff --git a/packages/shared/src/host/render.ts b/packages/shared/src/host/render.ts
index 1766bf5a..433af639 100644
--- a/packages/shared/src/host/render.ts
+++ b/packages/shared/src/host/render.ts
@@ -87,7 +87,11 @@ export interface BroadcastLinkOptions {
 
 const ABSOLUTE_URL = /\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/[^\s<>"'`)\]}]+/g
 const SCHEME_RELATIVE = /(^|[\s(<[{])(\/\/[^\s<>"'`)\]}]+)/g
-const DANGEROUS_SCHEME = /\b(javascript|data|vbscript|file|blob|jar|about):/gi
+// An executable scheme is refused wherever it starts a token, even with whitespace before its payload
+// (a browser runs "javascript: alert(1)" in an href). Only `about:` keeps a prose allowance ("Questions
+// about: parking"), and a scheme inside an https URL path ("/data:foo") is not a token start.
+const DANGEROUS_SCHEME =
+  /(?<![\w/.:-])(?:(javascript|data|vbscript|file|blob|jar):(?=\s*\S)|(about):(?=\S))/gi
 
 function hostAllowed(host: string, allowed: readonly string[]): boolean {
   return allowed.some((entry) => {
@@ -107,7 +111,7 @@ export function inspectBroadcastLinks(
   let count = 0
 
   for (const match of text.matchAll(DANGEROUS_SCHEME)) {
-    const scheme = (match[1] ?? "").toLowerCase()
+    const scheme = (match[1] ?? match[2] ?? "").toLowerCase()
     issues.push({ kind: "insecure_scheme", url: match[0] ?? "", scheme })
   }
 
diff --git a/packages/shared/src/host/turnstile.ts b/packages/shared/src/host/turnstile.ts
index ce151168..eb76cd29 100644
--- a/packages/shared/src/host/turnstile.ts
+++ b/packages/shared/src/host/turnstile.ts
@@ -1 +1,4 @@
+// The backend verifies each token against the action it was minted for, so these strings are a contract.
 export const GUEST_RSVP_TURNSTILE_ACTION = "guest-rsvp"
+export const ANON_REPORT_TURNSTILE_ACTION = "anon-report"
+export const HOME_TURF_TURNSTILE_ACTION = "home-turf"
diff --git a/packages/shared/src/ics/__tests__/build.test.ts b/packages/shared/src/ics/__tests__/build.test.ts
index 9079e76a..0b896eef 100644
--- a/packages/shared/src/ics/__tests__/build.test.ts
+++ b/packages/shared/src/ics/__tests__/build.test.ts
@@ -121,6 +121,32 @@ describe("buildIcs", () => {
     )
   })
 
+  it("emits URL and mailto values as URIs, without TEXT backslash escaping", () => {
+    const rows = unfold(
+      buildIcs({
+        ...BASE,
+        url: "https://civfix.org/e/creek?a=1,2;b=3",
+        organizer: { email: "ada,lovelace;x@civfix.org" },
+      }),
+    )
+    expect(rows).toContain("URL:https://civfix.org/e/creek?a=1,2;b=3")
+    expect(rows).toContain("ORGANIZER:mailto:ada,lovelace;x@civfix.org")
+  })
+
+  it("drops a URL the safe-https check refuses and an organizer email with control characters", () => {
+    for (const url of [
+      "https://user@civfix.org/x",
+      "https://192.168.0.1/x",
+      "https://xn--80ak6aa92e.com/x",
+      "https://civfix.org/a\u0001b",
+      `https://civfix.org/${"a".repeat(2048)}`,
+    ]) {
+      expect(unfold(buildIcs({ ...BASE, url })).some((row) => row.startsWith("URL:")), url).toBe(false)
+    }
+    const rows = unfold(buildIcs({ ...BASE, organizer: { email: "ada\u0001@civfix.org" } }))
+    expect(rows.some((row) => row.startsWith("ORGANIZER"))).toBe(false)
+  })
+
   it("supports cancellations, sequences and open-ended events", () => {
     const rows = unfold(
       buildIcs({ uid: "x", title: "T", startsAt: BASE.startsAt, status: "CANCELLED", sequence: 3 }),
diff --git a/packages/shared/src/ics/build.ts b/packages/shared/src/ics/build.ts
index a6e6101e..33f1067e 100644
--- a/packages/shared/src/ics/build.ts
+++ b/packages/shared/src/ics/build.ts
@@ -1,9 +1,12 @@
 import { isValidTimeZone } from "../datetime.js"
 import { intOr } from "../internal/numbers.js"
+import { isSafeHttpsUrl } from "../markdown/safe-url.js"
 
 export const ICS_PRODID = "-//civfix//civfix events//EN"
 export const ICS_UID_DOMAIN = "civfix.org"
 const FOLD_OCTETS = 75
+// eslint-disable-next-line no-control-regex -- a mailto value is emitted raw, so control characters must be refused
+const ORGANIZER_EMAIL = /^[^\s@\u0000-\u001f\u007f]+@[^\s@\u0000-\u001f\u007f]+$/u
 
 export type IcsStatus = "CONFIRMED" | "TENTATIVE" | "CANCELLED"
 
@@ -132,16 +135,18 @@ export function buildIcs(input: IcsEventInput): string {
     lines.push(`LOCATION:${escapeText(location)}`)
   }
 
+  // URL and ORGANIZER are URI / CAL-ADDRESS values (RFC 5545 3.3.3, 3.3.13), which take no TEXT
+  // backslash escaping; the validation is what keeps CR, LF and control characters out of the line.
   const url = input.url?.trim()
-  if (url !== undefined && /^https:\/\/\S+$/iu.test(url)) {
-    lines.push(`URL:${escapeText(url)}`)
+  if (url !== undefined && isSafeHttpsUrl(url)) {
+    lines.push(`URL:${url}`)
   }
 
   const organizerEmail = input.organizer?.email?.trim()
-  if (organizerEmail !== undefined && /^[^\s@]+@[^\s@]+$/u.test(organizerEmail)) {
+  if (organizerEmail !== undefined && ORGANIZER_EMAIL.test(organizerEmail)) {
     const name = input.organizer?.name?.trim()
     const cn = name !== undefined && name.length > 0 ? `;CN=${escapeParam(name)}` : ""
-    lines.push(`ORGANIZER${cn}:mailto:${escapeText(organizerEmail)}`)
+    lines.push(`ORGANIZER${cn}:mailto:${organizerEmail}`)
   }
 
   const sequence = intOr(input.sequence, 0, 0)
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index 4123084d..b902d2ca 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -35,6 +35,9 @@ export * from "./address.js"
 export * from "./avatar.js"
 export * from "./datetime.js"
 export * from "./number-format.js"
+export * from "./time-units.js"
+export * from "./url.js"
+export * from "./uuid.js"
 export * from "./chat/index.js"
 export * from "./ws/index.js"
 
diff --git a/packages/shared/src/interfaces/jobs.ts b/packages/shared/src/interfaces/jobs.ts
index 187cea8e..ef329cc1 100644
--- a/packages/shared/src/interfaces/jobs.ts
+++ b/packages/shared/src/interfaces/jobs.ts
@@ -12,6 +12,10 @@ export interface EnqueueOptions {
 export interface JobHandlerArg {
   id: string
   data: any
+  /** Retries already spent. Absent when the implementation does not track attempts. */
+  retryCount?: number
+  /** Set with `retryCount`; `retryCount >= retryLimit` marks the final attempt. */
+  retryLimit?: number
 }
 
 export type JobHandler = (job: JobHandlerArg) => Promise<void>
diff --git a/packages/shared/src/number-format.ts b/packages/shared/src/number-format.ts
index 5fdae020..729a1495 100644
--- a/packages/shared/src/number-format.ts
+++ b/packages/shared/src/number-format.ts
@@ -71,8 +71,8 @@ export function formatCount(value: number, locale: string, options: FormatCountO
 const CERTIFICATE_HOURS_MAX_FRACTION_DIGITS = 2
 
 /**
- * The one hours format for a service-hours certificate, so the printed PDF and the public verify page
- * can never show a registrar two different totals. The ledger has 0.25h granularity.
+ * The one hours format for a service-hours certificate, so the PDF's prose and the public verify page
+ * show a registrar the same total (the backend's PDF table still prints two fixed decimals).
  */
 export function formatCertificateHours(hours: number, locale: string): string {
   const options: Intl.NumberFormatOptions = {
diff --git a/packages/shared/src/schemas/__tests__/feed.test.ts b/packages/shared/src/schemas/__tests__/feed.test.ts
index 33b37cdb..c03550db 100644
--- a/packages/shared/src/schemas/__tests__/feed.test.ts
+++ b/packages/shared/src/schemas/__tests__/feed.test.ts
@@ -112,6 +112,14 @@ describe("feed score cursor", () => {
     expect(parseFeedScoreCursor(encoded)).toEqual({ score: 0, postId: UUID_B })
   })
 
+  it("lowercases the post id so it orders like the stored lowercase ids", () => {
+    const upper = "ABCDEF12-3456-7890-ABCD-EF1234567890"
+    const parsed = parseFeedScoreCursor(`5.000000|${upper}`)
+    expect(parsed).toEqual({ score: 5, postId: upper.toLowerCase() })
+    const nextRow = { score: 5, postId: "abcdef12-3456-7890-abcd-ef1234567889" }
+    expect(isAfterFeedScoreCursor(nextRow, parsed!)).toBe(true)
+  })
+
   it("does not claim a legacy ISO time cursor", () => {
     expect(parseFeedScoreCursor(`2026-09-14T10:00:00.000Z|${UUID_A}`)).toBeNull()
   })
diff --git a/packages/shared/src/schemas/__tests__/posts.test.ts b/packages/shared/src/schemas/__tests__/posts.test.ts
index a36622e1..fc70621d 100644
--- a/packages/shared/src/schemas/__tests__/posts.test.ts
+++ b/packages/shared/src/schemas/__tests__/posts.test.ts
@@ -6,6 +6,7 @@ import {
   PostRefDTOSchema,
 } from "../entities.js"
 import {
+  POST_BODY_MAX,
   PostComposeInputSchema,
   FeedPageDTOSchema,
   HomeFeedQuerySchema,
@@ -80,6 +81,14 @@ describe("PostDTOSchema round-trip", () => {
 })
 
 describe("PostComposeInputSchema refinements", () => {
+  it("caps the body at POST_BODY_MAX characters", () => {
+    expect(POST_BODY_MAX).toBe(2000)
+    expect(PostComposeInputSchema.safeParse({ body: "a".repeat(POST_BODY_MAX) }).success).toBe(true)
+    expect(PostComposeInputSchema.safeParse({ body: "a".repeat(POST_BODY_MAX + 1) }).success).toBe(
+      false,
+    )
+  })
+
   it("passes a text-only post (kind defaults to 'post')", () => {
     const res = PostComposeInputSchema.safeParse({ body: "hello neighbors" })
     expect(res.success).toBe(true)
diff --git a/packages/shared/src/schemas/admin/analytics.ts b/packages/shared/src/schemas/admin/analytics.ts
index ae0f0ff6..714a9ece 100644
--- a/packages/shared/src/schemas/admin/analytics.ts
+++ b/packages/shared/src/schemas/admin/analytics.ts
@@ -7,6 +7,20 @@ import { ReportCategorySchema } from "../common.js"
  * category.
  */
 
+export const AnalyticsKpiUnitSchema = z.enum(["count", "percent", "hours"])
+export type AnalyticsKpiUnit = z.infer<typeof AnalyticsKpiUnitSchema>
+
+/** The `key` values for the KPIs the backend's buildKpis produces, so a client matches a KPI without reading its label. */
+export const AnalyticsKpiKey = {
+  pinsThisMonth: "pins_this_month",
+  resolved: "resolved",
+  cleanupsPlanned: "cleanups_planned",
+  avgRouteTime: "avg_route_time",
+  eventsThisMonth: "events_this_month",
+  newUsers: "new_users",
+} as const
+export type AnalyticsKpiKey = (typeof AnalyticsKpiKey)[keyof typeof AnalyticsKpiKey]
+
 /** One KPI cell: a label, a value, a delta, and the delta direction (for the up/down arrow). */
 export const AnalyticsKpiSchema = z
   .object({
@@ -14,6 +28,9 @@ export const AnalyticsKpiSchema = z
     num: z.number(),
     delta: z.string(),
     dir: z.enum(["up", "down", "flat"]),
+    // An open string, not the AnalyticsKpiKey union, so a KPI added later still parses on older clients.
+    key: z.string().min(1).optional(),
+    unit: AnalyticsKpiUnitSchema.optional(),
   })
   .strict()
 export type AnalyticsKpi = z.infer<typeof AnalyticsKpiSchema>
diff --git a/packages/shared/src/schemas/admin/common.ts b/packages/shared/src/schemas/admin/common.ts
index 82349dd0..13447933 100644
--- a/packages/shared/src/schemas/admin/common.ts
+++ b/packages/shared/src/schemas/admin/common.ts
@@ -74,6 +74,20 @@ export function canTransitionReportStatus(from: AdminReportStatus, to: AdminRepo
   return ADMIN_REPORT_STATUS_TRANSITIONS[from].includes(to)
 }
 
+export const AdminReportStatusBucketSchema = z.enum(["submitted", "in_progress", "completed"])
+export type AdminReportStatusBucket = z.infer<typeof AdminReportStatusBucketSchema>
+
+// `published` and `held` sit in `submitted`: an authed pin is created published and is still awaiting
+// city action. `rejected` has no bucket because removal soft-deletes the report out of every list, so
+// the backend's list filters and counts and the admin pills must all read this one map.
+export const ADMIN_REPORT_STATUS_BUCKETS: Readonly<
+  Record<AdminReportStatusBucket, readonly AdminReportStatus[]>
+> = {
+  submitted: ["submitted", "held", "published"],
+  in_progress: ["acknowledged", "in_progress"],
+  completed: ["resolved"],
+}
+
 /** Cleanup (event) lifecycle. */
 export const EventStatusSchema = z.enum(["upcoming", "in_progress", "completed", "cancelled"])
 export type EventStatus = z.infer<typeof EventStatusSchema>
@@ -214,6 +228,10 @@ export type ModerationDestinationKind = z.infer<typeof ModerationDestinationKind
 export const ModerationToneSchema = z.enum(["ok", "warn", "bad"])
 export type ModerationTone = z.infer<typeof ModerationToneSchema>
 
+/** The backend mirrors this exact value list (the `moderation_items.status` CHECK constraint). */
+export const ModerationItemStatusSchema = z.enum(["open", "approved", "removed", "held"])
+export type ModerationItemStatus = z.infer<typeof ModerationItemStatusSchema>
+
 /** Queue priority bands shared by moderation + discovery rows. */
 export const PrioritySchema = z.enum(["low", "med", "high"])
 export type Priority = z.infer<typeof PrioritySchema>
diff --git a/packages/shared/src/schemas/admin/discovery.ts b/packages/shared/src/schemas/admin/discovery.ts
index 4cd1e1e9..3a0dd61c 100644
--- a/packages/shared/src/schemas/admin/discovery.ts
+++ b/packages/shared/src/schemas/admin/discovery.ts
@@ -1,5 +1,5 @@
 import { z } from "zod"
-import { ReportCategorySchema } from "../common.js"
+import { ISODateSchema, ReportCategorySchema } from "../common.js"
 import { pageResponse } from "../common.js"
 import { JurisdictionLayerSchema } from "../map.js"
 import { AdminListQuerySchema, PrioritySchema } from "./common.js"
@@ -93,6 +93,9 @@ export const DiscoveryContactSchema = z
   .object({
     category: ReportCategorySchema,
     email: z.string().email().nullable(),
+    // Set when mail to this address hard-bounced; routing skips it until then. Saving an email for the
+    // category (even the same address) clears it.
+    bouncedAt: ISODateSchema.nullable().optional(),
   })
   .strict()
 export type DiscoveryContact = z.infer<typeof DiscoveryContactSchema>
diff --git a/packages/shared/src/schemas/admin/events.ts b/packages/shared/src/schemas/admin/events.ts
index fb5f4254..2e25e281 100644
--- a/packages/shared/src/schemas/admin/events.ts
+++ b/packages/shared/src/schemas/admin/events.ts
@@ -117,10 +117,13 @@ export const SetEventStatusRequestSchema = z
   .strict()
 export type SetEventStatusRequest = z.infer<typeof SetEventStatusRequestSchema>
 
+// `flagged` sets the marker to that value so a retried request cannot undo itself; without it the
+// request toggles, as older admin builds expect.
 export const FlagEventRequestSchema = z
   .object({
     id: z.string(),
     reason: z.string().max(500).optional(),
+    flagged: z.boolean().optional(),
   })
   .strict()
 export type FlagEventRequest = z.infer<typeof FlagEventRequestSchema>
diff --git a/packages/shared/src/schemas/admin/forward-template.ts b/packages/shared/src/schemas/admin/forward-template.ts
index 675e39fd..6be00b9f 100644
--- a/packages/shared/src/schemas/admin/forward-template.ts
+++ b/packages/shared/src/schemas/admin/forward-template.ts
@@ -87,10 +87,6 @@ export const FORWARD_TEMPLATE_VARIABLES: readonly ForwardTemplateVariable[] = [
   },
 ]
 
-export const FORWARD_TEMPLATE_VARIABLE_NAMES: readonly string[] = FORWARD_TEMPLATE_VARIABLES.map((v) =>
-  v.token.slice(1, -1),
-)
-
 export type ForwardTemplateValues = Record<string, string>
 
 export const FORWARD_TEMPLATE_SAMPLE_VALUES: Readonly<ForwardTemplateValues> = {
diff --git a/packages/shared/src/schemas/admin/home.ts b/packages/shared/src/schemas/admin/home.ts
index c07162b7..ca309fae 100644
--- a/packages/shared/src/schemas/admin/home.ts
+++ b/packages/shared/src/schemas/admin/home.ts
@@ -67,6 +67,9 @@ export const HomeSummaryResponseSchema = z
     livePins24h: z.number().int().nonnegative(),
     moderationQueue: z.number().int().nonnegative().optional(),
     inboxUnread: z.number().int().nonnegative().optional(),
+    // The top-level keys whose query failed and were filled with zeros, so a tile can render as
+    // unavailable instead of showing a real-looking 0.
+    degraded: z.array(z.string()).optional(),
   })
   .strict()
 export type HomeSummaryResponse = z.infer<typeof HomeSummaryResponseSchema>
diff --git a/packages/shared/src/schemas/admin/mail.ts b/packages/shared/src/schemas/admin/mail.ts
index e94ea400..1c3ebe82 100644
--- a/packages/shared/src/schemas/admin/mail.ts
+++ b/packages/shared/src/schemas/admin/mail.ts
@@ -12,7 +12,11 @@ import {
 
 export const MailAttachmentSchema = z
   .object({
+    // Read endpoints overwrite `key` with the presigned link for older admin builds; `url` carries the
+    // same link under an honest name. It expires MEDIA_GET_URL_TTL_SEC (15 minutes) after the response
+    // is built, so refetch the message instead of caching the link.
     key: z.string(),
+    url: z.string().url().optional(),
     filename: z.string(),
     size: z.number().int().nonnegative(),
   })
diff --git a/packages/shared/src/schemas/admin/moderation.ts b/packages/shared/src/schemas/admin/moderation.ts
index fb27c731..fb16efc7 100644
--- a/packages/shared/src/schemas/admin/moderation.ts
+++ b/packages/shared/src/schemas/admin/moderation.ts
@@ -7,6 +7,7 @@ import {
   ModerationKindSchema,
   ModerationSubjectTypeSchema,
   ModerationToneSchema,
+  ModerationItemStatusSchema,
   PrioritySchema,
 } from "./common.js"
 import { AdminMediaRefSchema } from "./internal-fields.js"
@@ -113,6 +114,8 @@ export const ModerationItemDTOSchema = ModerationListItemDTOSchema.extend({
   user: ModerationUserSchema,
   similar: z.array(ModerationSimilarSchema),
   media: z.array(ModerationMediaSchema),
+  // The detail endpoint also returns resolved items, which must not offer the decision actions again.
+  status: ModerationItemStatusSchema.optional(),
 }).strict()
 export type ModerationItemDTO = z.infer<typeof ModerationItemDTOSchema>
 
diff --git a/packages/shared/src/schemas/admin/reports.ts b/packages/shared/src/schemas/admin/reports.ts
index 59c7c81e..68b41d3f 100644
--- a/packages/shared/src/schemas/admin/reports.ts
+++ b/packages/shared/src/schemas/admin/reports.ts
@@ -8,6 +8,7 @@ import {
   AdminCoordsSchema,
   AdminReportStatusSchema,
   AdminListQuerySchema,
+  AdminOkResponseSchema,
   RelAbsTimeSchema,
 } from "./common.js"
 import { AdminMediaRefSchema } from "./internal-fields.js"
@@ -200,6 +201,7 @@ export const FlagReportRequestSchema = z
   .object({
     id: z.string(),
     reason: z.string().max(500).optional(),
+    flagged: z.boolean().optional(),
   })
   .strict()
 export type FlagReportRequest = z.infer<typeof FlagReportRequestSchema>
@@ -263,7 +265,7 @@ export const SetReportVerdictRequestSchema = z
   .strict()
 export type SetReportVerdictRequest = z.infer<typeof SetReportVerdictRequestSchema>
 
-export const SetReportVerdictResponseSchema = z.object({ ok: z.literal(true) }).strict()
+export const SetReportVerdictResponseSchema = AdminOkResponseSchema
 export type SetReportVerdictResponse = z.infer<typeof SetReportVerdictResponseSchema>
 
 export const AdminReportMessagesRequestSchema = ReportChatHistoryRequestSchema
diff --git a/packages/shared/src/schemas/admin/users.ts b/packages/shared/src/schemas/admin/users.ts
index 106b5415..2498c58d 100644
--- a/packages/shared/src/schemas/admin/users.ts
+++ b/packages/shared/src/schemas/admin/users.ts
@@ -1,6 +1,7 @@
 import { z } from "zod"
 import {
   CleanupMemberRoleSchema,
+  CursorSchema,
   ReportCategorySchema,
   ISODateSchema,
   IdSchema,
@@ -16,6 +17,9 @@ import {
   UserStatusSchema,
 } from "./common.js"
 
+export const MessageRemovedBySchema = z.enum(["author", "operator"])
+export type MessageRemovedBy = z.infer<typeof MessageRemovedBySchema>
+
 /**
  * A user list row. `reports`/`cleanups` are derived counts; `removals`/`strikes` come from the
  * moderation side table; `risk` is the moderation risk band; `flagged`/`flagReason` the abuse marker.
@@ -56,6 +60,9 @@ export type AdminUserListItemDTO = z.infer<typeof AdminUserListItemDTOSchema>
  */
 export const AdminUserListQuerySchema = AdminListQuerySchema.extend({
   filter: z.enum(["all", "active", "suspended", "flagged", "deleted", "banned"]).optional(),
+  // Leaves out the members of this organization server-side, so an add-member picker's page is not
+  // spent on people who are already members.
+  excludeOrgId: IdSchema.optional(),
 })
 export type AdminUserListQuery = z.infer<typeof AdminUserListQuerySchema>
 
@@ -117,7 +124,7 @@ export type GetAdminUserResponse = z.infer<typeof GetAdminUserResponseSchema>
  */
 export const UserSubListQuerySchema = z.object({
   id: z.string(),
-  cursor: z.string().optional(),
+  cursor: CursorSchema.optional(),
   limit: z.coerce.number().int().positive().max(100).optional(),
 })
 export type UserSubListQuery = z.infer<typeof UserSubListQuerySchema>
@@ -164,6 +171,9 @@ export const UserMessageItemDTOSchema = z
     // When the user themselves deleted (tombstoned) this message; null/omitted => not user-deleted.
     // Operators keep full visibility of the original text. Optional so an older server still parses.
     deletedAt: ISODateSchema.nullable().optional(),
+    // Author self-deletion and operator removal both set `deletedAt`; this tells them apart. Null when
+    // the message is live.
+    removedBy: MessageRemovedBySchema.nullable().optional(),
     // `chat` is cleanup/event chat; `group` is a standalone group or channel. They intentionally remain
     // distinct because only cleanup chat has an admin event destination.
     source: z.enum(["chat", "group", "dm", "report"]).optional(),
@@ -181,6 +191,7 @@ export const FlagUserRequestSchema = z
   .object({
     id: z.string(),
     reason: z.string().max(500).optional(),
+    flagged: z.boolean().optional(),
   })
   .strict()
 export type FlagUserRequest = z.infer<typeof FlagUserRequestSchema>
diff --git a/packages/shared/src/schemas/auth.ts b/packages/shared/src/schemas/auth.ts
index 8fd12a76..5c5c72a9 100644
--- a/packages/shared/src/schemas/auth.ts
+++ b/packages/shared/src/schemas/auth.ts
@@ -9,7 +9,10 @@ import { RoleSchema } from "../types/roles.js"
  * against it.
  */
 export const LocaleEnum = z.enum(["en", "es", "de", "ko"])
-export type SupportedLocale = z.infer<typeof LocaleEnum>
+// The XxxSchema-convention name. LocaleEnum stays as the same schema: dropping a published name breaks
+// its consumers.
+export const SupportedLocaleSchema = LocaleEnum
+export type SupportedLocale = z.infer<typeof SupportedLocaleSchema>
 
 export const AppleSignInRequestSchema = z
   .object({
@@ -70,11 +73,13 @@ export type EmailOtpRequestResponse = z.infer<typeof EmailOtpRequestResponseSche
 
 export const REVIEWER_OTP_EMAIL = "reviewer@civfix.org"
 
+export const EMAIL_OTP_CODE_LENGTH = 6
+
 export const REVIEWER_OTP_CODE_MIN_LENGTH = 20
 export const REVIEWER_OTP_CODE_MAX_LENGTH = 128
 
 export const OtpCodeSchema = z.union([
-  z.string().regex(/^\d{6}$/),
+  z.string().regex(new RegExp(`^\\d{${EMAIL_OTP_CODE_LENGTH}}$`)),
   z.string().min(REVIEWER_OTP_CODE_MIN_LENGTH).max(REVIEWER_OTP_CODE_MAX_LENGTH),
 ])
 
@@ -109,7 +114,7 @@ export const UserDTOSchema = z.object({
   handleChangeableAt: z.string().datetime().nullable().optional(),
   // Drives client UI language and server-generated copy. `.catch` coerces an out-of-domain value and
   // `.default` fills an absent one, so a server with a newer or missing locale still parses.
-  locale: LocaleEnum.catch("en").default("en"),
+  locale: SupportedLocaleSchema.catch("en").default("en"),
   // Which organization membership is published as the profile affiliation badge (DECISIONS §34); null
   // means the earliest membership. Optional so older servers parse.
   primaryOrganizationId: IdSchema.nullable().optional(),
diff --git a/packages/shared/src/schemas/certificates.ts b/packages/shared/src/schemas/certificates.ts
index a4abd455..e1b5bae9 100644
--- a/packages/shared/src/schemas/certificates.ts
+++ b/packages/shared/src/schemas/certificates.ts
@@ -1,5 +1,5 @@
 import { z } from "zod"
-import { LocaleEnum } from "./auth.js"
+import { SupportedLocaleSchema } from "./auth.js"
 
 /*
  * A certificate is a PDF the holder deliberately hands to a verifier (a school registrar, a court
@@ -76,7 +76,7 @@ export type ServiceHoursCertificateDTO = z.infer<typeof ServiceHoursCertificateD
  * derived min/max of the included rows.
  */
 export const IssueServiceHoursCertificateRequestSchema = z
-  .object({ locale: LocaleEnum.optional() })
+  .object({ locale: SupportedLocaleSchema.optional() })
   .strict()
 export type IssueServiceHoursCertificateRequest = z.infer<
   typeof IssueServiceHoursCertificateRequestSchema
diff --git a/packages/shared/src/schemas/chat.ts b/packages/shared/src/schemas/chat.ts
index 0d92fdae..055f77c0 100644
--- a/packages/shared/src/schemas/chat.ts
+++ b/packages/shared/src/schemas/chat.ts
@@ -199,12 +199,17 @@ export type ToggleReportMessageReactionRequest = z.infer<
 export const PollRoomKindSchema = z.enum(["cleanup", "report", "group"])
 export type PollRoomKind = z.infer<typeof PollRoomKindSchema>
 
+export const POLL_QUESTION_MAX = 300
+export const POLL_OPTION_MAX = 100
+export const POLL_MIN_OPTIONS = 2
+export const POLL_MAX_OPTIONS = 10
+
 export const CreatePollRequestSchema = z
   .object({
     roomKind: PollRoomKindSchema,
     roomId: IdSchema,
-    question: z.string().min(1).max(300),
-    options: z.array(z.string().min(1).max(100)).min(2).max(10),
+    question: z.string().min(1).max(POLL_QUESTION_MAX),
+    options: z.array(z.string().min(1).max(POLL_OPTION_MAX)).min(POLL_MIN_OPTIONS).max(POLL_MAX_OPTIONS),
     allowMultiple: z.boolean().default(false),
     anonymous: z.boolean().default(true),
   })
@@ -214,7 +219,7 @@ export type CreatePollRequest = z.infer<typeof CreatePollRequestSchema>
 export const VotePollRequestSchema = z
   .object({
     messageId: IdSchema,
-    optionIdxs: z.array(z.number().int().min(0).max(9)).max(10),
+    optionIdxs: z.array(z.number().int().min(0).max(POLL_MAX_OPTIONS - 1)).max(POLL_MAX_OPTIONS),
   })
   .strict()
 export type VotePollRequest = z.infer<typeof VotePollRequestSchema>
diff --git a/packages/shared/src/schemas/cleanups.ts b/packages/shared/src/schemas/cleanups.ts
index dda77f4e..64afe5aa 100644
--- a/packages/shared/src/schemas/cleanups.ts
+++ b/packages/shared/src/schemas/cleanups.ts
@@ -5,6 +5,7 @@ import {
   LatLngFields,
   LatLngSchema,
   BBoxSchema,
+  EMAIL_MAX_LENGTH,
   EventVisibilitySchema,
   PaginationQuerySchema,
   MAX_PARTY_SIZE,
@@ -54,6 +55,10 @@ export const MAX_LINKED_REPORTS = 200
 export const MAX_EVENT_ADDRESS_LENGTH = 200
 export const MIN_EVENT_DURATION_MINUTES = 15
 export const MAX_EVENT_DURATION_MINUTES = 1440
+export const MAX_EVENT_TITLE = 120
+export const MAX_EVENT_DESCRIPTION = 2000
+export const MAX_EVENT_CANCEL_REASON = 500
+export const MAX_EVENT_RESOURCES_MESSAGE = 2000
 export { DEFAULT_EVENT_DURATION_MINUTES } from "./event-duration.js"
 
 const EventSlotInputObjectSchema = z
@@ -118,10 +123,10 @@ const HostEventFields = {
 
 export const CreateCleanupRequestSchema = z
   .object({
-    title: z.string().min(1).max(120),
+    title: z.string().min(1).max(MAX_EVENT_TITLE),
     type: CleanupTypeSchema,
     eventKind: EventKindSchema.default("cleanup"),
-    description: z.string().max(2000).optional(),
+    description: z.string().max(MAX_EVENT_DESCRIPTION).optional(),
     ...LatLngFields,
     scheduledAt: ISODateSchema,
     bring: z.array(z.string()).max(MAX_BRING_ITEMS).optional(),
@@ -138,8 +143,8 @@ export type CreateCleanupRequest = z.infer<typeof CreateCleanupRequestSchema>
 export const UpdateCleanupRequestSchema = z
   .object({
     id: IdSchema,
-    title: z.string().min(1).max(120).optional(),
-    description: z.string().max(2000).optional(),
+    title: z.string().min(1).max(MAX_EVENT_TITLE).optional(),
+    description: z.string().max(MAX_EVENT_DESCRIPTION).optional(),
     eventKind: EventKindSchema.optional(),
     type: CleanupTypeSchema.optional(),
     scheduledAt: ISODateSchema.optional(),
@@ -177,7 +182,7 @@ export type DuplicateCleanupRequest = z.infer<typeof DuplicateCleanupRequestSche
 export const CancelCleanupRequestSchema = z
   .object({
     id: IdSchema,
-    reason: z.string().max(500).optional(),
+    reason: z.string().max(MAX_EVENT_CANCEL_REASON).optional(),
   })
   .strict()
 export type CancelCleanupRequest = z.infer<typeof CancelCleanupRequestSchema>
@@ -233,7 +238,7 @@ export type CleanupAttendeesResponse = z.infer<typeof CleanupAttendeesResponseSc
 export const RequestEventResourcesRequestSchema = z
   .object({
     id: IdSchema,
-    message: z.string().min(1).max(2000),
+    message: z.string().min(1).max(MAX_EVENT_RESOURCES_MESSAGE),
   })
   .strict()
 export type RequestEventResourcesRequest = z.infer<typeof RequestEventResourcesRequestSchema>
@@ -284,9 +289,25 @@ export const GuestOtpErrorReason = {
 } as const
 export type GuestOtpErrorReason = (typeof GuestOtpErrorReason)[keyof typeof GuestOtpErrorReason]
 
+export const GUEST_REGISTRATION_ERROR_FIELD = "registration"
+
+export const GuestRegistrationRefusalReason = {
+  soldOut: "sold_out",
+  registrationClosed: "registration_closed",
+  salesClosed: "sales_closed",
+  eventClosed: "event_closed",
+  partyTooLarge: "party_too_large",
+  ticketTypeUnavailable: "ticket_type_unavailable",
+  accessCodeRequired: "access_code_required",
+  accessCodeInvalid: "access_code_invalid",
+  answersInvalid: "answers_invalid",
+} as const
+export type GuestRegistrationRefusalReason =
+  (typeof GuestRegistrationRefusalReason)[keyof typeof GuestRegistrationRefusalReason]
+
 export const GuestPhoneSchema = z.string().regex(/^\+1[2-9]\d{9}$/)
 
-const GuestEmailSchema = z.string().email().max(254).toLowerCase()
+const GuestEmailSchema = z.string().email().max(EMAIL_MAX_LENGTH).toLowerCase()
 
 const GuestContactFields = {
   channel: GuestContactChannelSchema,
diff --git a/packages/shared/src/schemas/common.ts b/packages/shared/src/schemas/common.ts
index 306a2594..e2fc4c0b 100644
--- a/packages/shared/src/schemas/common.ts
+++ b/packages/shared/src/schemas/common.ts
@@ -66,8 +66,7 @@ export const ISODateSchema = z
   .transform((d) => d.toISOString())
 export type ISODate = string
 
-export const H3CellSchema = z.string().min(1)
-export type H3Cell = z.infer<typeof H3CellSchema>
+export type H3Cell = string
 
 export const AppErrorSchema = z.object({
   code: z.string(),
@@ -163,10 +162,6 @@ export const REPORT_TYPE_CODE: Record<ReportType, string> = {
   other: "OT",
 }
 
-export const REPORT_CODE_TO_TYPE = Object.fromEntries(
-  Object.entries(REPORT_TYPE_CODE).map(([t, c]) => [c, t]),
-) as Record<string, ReportType>
-
 export const GeomSourceSchema = z.enum(["device", "exif", "manual"])
 export type GeomSource = z.infer<typeof GeomSourceSchema>
 
@@ -236,6 +231,9 @@ export const DELETED_USER_LABEL = "Deleted User"
 
 export const MESSAGE_BODY_MAX = 2000
 
+// RFC 5321 caps a forward-path at 256 octets including the angle brackets.
+export const EMAIL_MAX_LENGTH = 254
+
 export const RoomKindSchema = z.enum(["cleanup", "dm", "report", "group"])
 export type RoomKind = z.infer<typeof RoomKindSchema>
 
@@ -416,17 +414,10 @@ export type LegalDocumentType = z.infer<typeof LegalDocumentTypeSchema>
 export const ConsentSurfaceSchema = z.enum(["web_register", "mobile_register", "onboarding"])
 export type ConsentSurface = z.infer<typeof ConsentSurfaceSchema>
 
-
-export interface GovTarget {
-  name: string
-  email: string
-}
-
 export interface WebReportType {
   id: string
   label: string
   category: ReportCategory
-  gov: GovTarget
 }
 
 export const WEB_REPORT_TYPES = [
@@ -434,59 +425,42 @@ export const WEB_REPORT_TYPES = [
     id: "dump",
     label: "Illegal dumping",
     category: "trash",
-    gov: { name: "LA Bureau of Sanitation", email: "sanitation@lacity.gov" },
   },
   {
     id: "encampment",
     label: "Encampment",
     category: "encampment",
-    gov: { name: "LA Bureau of Sanitation", email: "sanitation@lacity.gov" },
   },
   {
     id: "graffiti",
     label: "Graffiti",
     category: "graffiti",
-    gov: { name: "Office of Community Beautification", email: "ocb@lacity.gov" },
   },
   {
     id: "infrastructure",
     label: "Broken infrastructure",
     category: "water",
-    gov: { name: "LA Bureau of Street Services", email: "streetservices@lacity.gov" },
   },
   {
     id: "pavement",
     label: "Pavement distress",
     category: "hazard",
-    gov: { name: "LA Bureau of Street Services", email: "streetservices@lacity.gov" },
   },
   {
     id: "vegetation",
     label: "Overgrown vegetation",
     category: "recycling",
-    gov: { name: "LA Bureau of Street Services", email: "streetservices@lacity.gov" },
   },
   {
     id: "water",
     label: "Water/leak",
     category: "water",
-    gov: { name: "LADWP", email: "customerservice@ladwp.com" },
   },
   {
     id: "recycling",
     label: "Recycling",
     category: "recycling",
-    gov: { name: "LA Bureau of Sanitation", email: "sanitation@lacity.gov" },
   },
 ] as const satisfies readonly WebReportType[]
 
 export type WebReportTypeId = (typeof WEB_REPORT_TYPES)[number]["id"]
-
-export const WEB_REPORT_TYPE_BY_ID: Record<WebReportTypeId, WebReportType> = Object.fromEntries(
-  WEB_REPORT_TYPES.map((t) => [t.id, t]),
-) as Record<WebReportTypeId, WebReportType>
-
-export function webReportTypeToCategory(id: string): ReportCategory {
-  const entry = WEB_REPORT_TYPE_BY_ID[id as WebReportTypeId]
-  return entry ? entry.category : "other"
-}
diff --git a/packages/shared/src/schemas/content-report.ts b/packages/shared/src/schemas/content-report.ts
index b7eddfd3..4bb4ab5e 100644
--- a/packages/shared/src/schemas/content-report.ts
+++ b/packages/shared/src/schemas/content-report.ts
@@ -10,12 +10,14 @@ import { OkResponseSchema } from "./internal-fields.js"
  * POST /content-reports: a citizen flags a piece of UGC with a reason and optional free-text detail.
  * The subject is identified by (subjectType, subjectId), which the server fans into the moderation queue.
  */
+export const CONTENT_REPORT_DETAILS_MAX = 1000
+
 export const ReportContentRequestSchema = z
   .object({
     subjectType: ContentReportSubjectSchema,
     subjectId: IdSchema,
     reason: ContentReportReasonSchema,
-    details: z.string().trim().max(1000).optional(),
+    details: z.string().trim().max(CONTENT_REPORT_DETAILS_MAX).optional(),
   })
   .strict()
 export type ReportContentRequest = z.infer<typeof ReportContentRequestSchema>
diff --git a/packages/shared/src/schemas/entities.ts b/packages/shared/src/schemas/entities.ts
index 977e2fa1..5c09a6d3 100644
--- a/packages/shared/src/schemas/entities.ts
+++ b/packages/shared/src/schemas/entities.ts
@@ -7,6 +7,7 @@ import {
   CheckinMethodSchema,
   CleanupMemberRoleSchema,
   EventPageStatusSchema,
+  EMAIL_MAX_LENGTH,
   EventVisibilitySchema,
   HostCapabilitySchema,
   IdSchema,
@@ -33,7 +34,9 @@ import {
 import { MARKDOWN_SUBSET_MAX_CHARS } from "../markdown/parse.js"
 import { isSafeHttpsUrl } from "../markdown/safe-url.js"
 
-export const HttpsUrlSchema = z.string().trim().url().max(500).startsWith("https://")
+export const HTTPS_URL_MAX_LENGTH = 500
+
+export const HttpsUrlSchema = z.string().trim().url().max(HTTPS_URL_MAX_LENGTH).startsWith("https://")
 
 export const AvatarPairSchema = z.tuple([z.string(), z.string()]).nullable().optional()
 
@@ -147,8 +150,19 @@ export const SOCIAL_PLATFORM_LABELS: Record<SocialPlatform, string> = {
   whatsapp: "WhatsApp",
 }
 
-const SocialHandleSchema = z.string().trim().regex(/^[A-Za-z0-9._]{1,30}$/)
-const WhatsAppNumberSchema = z.string().trim().regex(/^[1-9]\d{6,14}$/)
+export const SOCIAL_HANDLE_MAX_LENGTH = 30
+// E.164: at most 15 digits, and the country code never starts with 0.
+export const WHATSAPP_NUMBER_MAX_LENGTH = 15
+const WHATSAPP_NUMBER_MIN_LENGTH = 7
+
+const SocialHandleSchema = z
+  .string()
+  .trim()
+  .regex(new RegExp(`^[A-Za-z0-9._]{1,${SOCIAL_HANDLE_MAX_LENGTH}}$`))
+const WhatsAppNumberSchema = z
+  .string()
+  .trim()
+  .regex(new RegExp(`^[1-9]\\d{${WHATSAPP_NUMBER_MIN_LENGTH - 1},${WHATSAPP_NUMBER_MAX_LENGTH - 1}}$`))
 
 export const SocialLinksSchema = z
   .object({
@@ -161,6 +175,16 @@ export const SocialLinksSchema = z
   .strict()
 export type SocialLinks = z.infer<typeof SocialLinksSchema>
 
+// What a form shows in front of the field so the user types only the handle. Deliberately shorter than
+// socialLinkUrl's link targets: it is display text, not a URL.
+export const SOCIAL_HANDLE_PREFIX: Readonly<Record<SocialPlatform, string>> = {
+  facebook: "facebook.com/",
+  instagram: "instagram.com/",
+  tiktok: "tiktok.com/@",
+  x: "x.com/",
+  whatsapp: "+",
+}
+
 export function socialLinkUrl(platform: SocialPlatform, value: string): string {
   switch (platform) {
     case "facebook":
@@ -459,7 +483,24 @@ export const SafeHttpsLinkSchema = z
     message: SAFE_HTTPS_LINK_MESSAGE,
   })
 
-export const HostEventEmailSchema = z.string().trim().toLowerCase().email().max(254)
+export const HostEventEmailSchema = z.string().trim().toLowerCase().email().max(EMAIL_MAX_LENGTH)
+
+export const EVENT_PAGE_BLOCK_LIMITS = {
+  title: 160,
+  heroHeadline: 160,
+  heroSubhead: 320,
+  text: 1200,
+  agendaItems: 30,
+  agendaTime: 40,
+  agendaItemTitle: 160,
+  rowDescription: 600,
+  hostEntries: 20,
+  entryName: 120,
+  hostRole: 80,
+  faqItems: 30,
+  faqQuestion: 200,
+  sponsorEntries: 20,
+} as const
 
 const EventPageBlockBaseFields = {
   id: z.string().min(1).max(64),
@@ -467,18 +508,18 @@ const EventPageBlockBaseFields = {
 
 const AgendaItemSchema = z
   .object({
-    time: z.string().max(40).nullable().optional(),
-    title: z.string().min(1).max(160),
-    description: z.string().max(600).nullable().optional(),
+    time: z.string().max(EVENT_PAGE_BLOCK_LIMITS.agendaTime).nullable().optional(),
+    title: z.string().min(1).max(EVENT_PAGE_BLOCK_LIMITS.agendaItemTitle),
+    description: z.string().max(EVENT_PAGE_BLOCK_LIMITS.rowDescription).nullable().optional(),
   })
   .strict()
 
 const PageHostEntrySchema = z
   .object({
     userId: IdSchema.nullable().optional(),
-    name: z.string().min(1).max(120),
-    role: z.string().max(80).nullable().optional(),
-    bio: z.string().max(600).nullable().optional(),
+    name: z.string().min(1).max(EVENT_PAGE_BLOCK_LIMITS.entryName),
+    role: z.string().max(EVENT_PAGE_BLOCK_LIMITS.hostRole).nullable().optional(),
+    bio: z.string().max(EVENT_PAGE_BLOCK_LIMITS.rowDescription).nullable().optional(),
     avatarMediaId: IdSchema.nullable().optional(),
     avatarUrl: PageImageUrlSchema.nullable().optional(),
   })
@@ -486,14 +527,14 @@ const PageHostEntrySchema = z
 
 const FaqItemSchema = z
   .object({
-    question: z.string().min(1).max(200),
-    answer: z.string().min(1).max(1200),
+    question: z.string().min(1).max(EVENT_PAGE_BLOCK_LIMITS.faqQuestion),
+    answer: z.string().min(1).max(EVENT_PAGE_BLOCK_LIMITS.text),
   })
   .strict()
 
 const SponsorEntrySchema = z
   .object({
-    name: z.string().min(1).max(120),
+    name: z.string().min(1).max(EVENT_PAGE_BLOCK_LIMITS.entryName),
     url: SafeHttpsLinkSchema.nullable().optional(),
     logoMediaId: IdSchema.nullable().optional(),
     logoUrl: PageImageUrlSchema.nullable().optional(),
@@ -505,8 +546,8 @@ const EventPageBlockUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("hero"),
-      headline: z.string().max(160).nullable().optional(),
-      subhead: z.string().max(320).nullable().optional(),
+      headline: z.string().max(EVENT_PAGE_BLOCK_LIMITS.heroHeadline).nullable().optional(),
+      subhead: z.string().max(EVENT_PAGE_BLOCK_LIMITS.heroSubhead).nullable().optional(),
       mediaId: IdSchema.nullable().optional(),
       imageUrl: PageImageUrlSchema.nullable().optional(),
     })
@@ -515,7 +556,7 @@ const EventPageBlockUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("about"),
-      title: z.string().max(160).nullable().optional(),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
       body: z.string().max(MARKDOWN_SUBSET_MAX_CHARS),
     })
     .strict(),
@@ -523,32 +564,32 @@ const EventPageBlockUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("agenda"),
-      title: z.string().max(160).nullable().optional(),
-      items: z.array(AgendaItemSchema).max(30).default([]),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      items: z.array(AgendaItemSchema).max(EVENT_PAGE_BLOCK_LIMITS.agendaItems).default([]),
     })
     .strict(),
   z
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("hosts"),
-      title: z.string().max(160).nullable().optional(),
-      entries: z.array(PageHostEntrySchema).max(20).default([]),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      entries: z.array(PageHostEntrySchema).max(EVENT_PAGE_BLOCK_LIMITS.hostEntries).default([]),
     })
     .strict(),
   z
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("faq"),
-      title: z.string().max(160).nullable().optional(),
-      items: z.array(FaqItemSchema).max(30).default([]),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      items: z.array(FaqItemSchema).max(EVENT_PAGE_BLOCK_LIMITS.faqItems).default([]),
     })
     .strict(),
   z
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("location"),
-      title: z.string().max(160).nullable().optional(),
-      note: z.string().max(1200).nullable().optional(),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      note: z.string().max(EVENT_PAGE_BLOCK_LIMITS.text).nullable().optional(),
       showMap: z.boolean().default(true),
     })
     .strict(),
@@ -556,16 +597,16 @@ const EventPageBlockUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("sponsors"),
-      title: z.string().max(160).nullable().optional(),
-      entries: z.array(SponsorEntrySchema).max(20).default([]),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      entries: z.array(SponsorEntrySchema).max(EVENT_PAGE_BLOCK_LIMITS.sponsorEntries).default([]),
     })
     .strict(),
   z
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("donate"),
-      title: z.string().max(160).nullable().optional(),
-      blurb: z.string().max(1200).nullable().optional(),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      blurb: z.string().max(EVENT_PAGE_BLOCK_LIMITS.text).nullable().optional(),
       url: SafeHttpsLinkSchema.nullable().optional(),
     })
     .strict(),
@@ -573,16 +614,16 @@ const EventPageBlockUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("registration"),
-      title: z.string().max(160).nullable().optional(),
-      note: z.string().max(1200).nullable().optional(),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      note: z.string().max(EVENT_PAGE_BLOCK_LIMITS.text).nullable().optional(),
     })
     .strict(),
   z
     .object({
       ...EventPageBlockBaseFields,
       kind: z.literal("contact"),
-      title: z.string().max(160).nullable().optional(),
-      body: z.string().max(1200).nullable().optional(),
+      title: z.string().max(EVENT_PAGE_BLOCK_LIMITS.title).nullable().optional(),
+      body: z.string().max(EVENT_PAGE_BLOCK_LIMITS.text).nullable().optional(),
       replyTo: HostEventEmailSchema.nullable().optional(),
     })
     .strict(),
diff --git a/packages/shared/src/schemas/groups.ts b/packages/shared/src/schemas/groups.ts
index d7b27dd8..54709d7a 100644
--- a/packages/shared/src/schemas/groups.ts
+++ b/packages/shared/src/schemas/groups.ts
@@ -38,11 +38,14 @@ export const GroupMemberDTOSchema = z.object({
 })
 export type GroupMemberDTO = z.infer<typeof GroupMemberDTOSchema>
 
+export const CHAT_GROUP_NAME_MAX = 80
+export const CHAT_GROUP_DESCRIPTION_MAX = 500
+
 export const CreateChatGroupRequestSchema = z
   .object({
     kind: GroupKindSchema.default("group"),
-    name: z.string().min(1).max(80),
-    description: z.string().max(500).optional(),
+    name: z.string().min(1).max(CHAT_GROUP_NAME_MAX),
+    description: z.string().max(CHAT_GROUP_DESCRIPTION_MAX).optional(),
     avatarUploadId: IdSchema.optional(),
     visibility: GroupVisibilitySchema.default("private"),
     memberIds: z.array(IdSchema).max(50).default([]),
@@ -60,8 +63,8 @@ export type GetChatGroupRequest = z.infer<typeof GetChatGroupRequestSchema>
 export const UpdateChatGroupRequestSchema = z
   .object({
     id: IdSchema,
-    name: z.string().min(1).max(80).optional(),
-    description: z.string().max(500).optional(),
+    name: z.string().min(1).max(CHAT_GROUP_NAME_MAX).optional(),
+    description: z.string().max(CHAT_GROUP_DESCRIPTION_MAX).optional(),
     avatarUploadId: IdSchema.optional(),
     visibility: GroupVisibilitySchema.optional(),
   })
diff --git a/packages/shared/src/schemas/host/broadcasts.ts b/packages/shared/src/schemas/host/broadcasts.ts
index 93d0a976..74e6b400 100644
--- a/packages/shared/src/schemas/host/broadcasts.ts
+++ b/packages/shared/src/schemas/host/broadcasts.ts
@@ -51,13 +51,11 @@ export const HostBroadcastChannelsSchema = z
   .max(3)
   .refine(hostBroadcastChannelsValid, { message: PUSH_REQUIRES_INAPP_MESSAGE })
 
-export const HttpsCtaUrlSchema = HttpsUrlSchema
-
 const BroadcastDraftFields = {
   subject: z.string().trim().min(1).max(MAX_BROADCAST_SUBJECT),
   bodyMd: z.string().trim().min(1).max(MAX_BROADCAST_BODY),
   ctaLabel: z.string().trim().max(MAX_BROADCAST_CTA_LABEL).nullable().optional(),
-  ctaUrl: HttpsCtaUrlSchema.nullable().optional(),
+  ctaUrl: HttpsUrlSchema.nullable().optional(),
   segment: BroadcastSegmentSchema,
   channels: HostBroadcastChannelsSchema,
 } as const
diff --git a/packages/shared/src/schemas/host/insights.ts b/packages/shared/src/schemas/host/insights.ts
index feb531df..fc5e8f96 100644
--- a/packages/shared/src/schemas/host/insights.ts
+++ b/packages/shared/src/schemas/host/insights.ts
@@ -106,9 +106,6 @@ const EventInsightsObjectSchema = z.object({
 })
 export type EventInsights = z.infer<typeof EventInsightsObjectSchema>
 
-export const EventInsightsSchema: z.ZodType<EventInsights, z.ZodTypeDef, unknown> =
-  EventInsightsObjectSchema
-
 export const GetEventInsightsRequestSchema = z.object({ id: IdSchema }).strict()
 export type GetEventInsightsRequest = z.infer<typeof GetEventInsightsRequestSchema>
 
diff --git a/packages/shared/src/schemas/host/organizations.ts b/packages/shared/src/schemas/host/organizations.ts
index cd3faf86..8cceee0a 100644
--- a/packages/shared/src/schemas/host/organizations.ts
+++ b/packages/shared/src/schemas/host/organizations.ts
@@ -1,5 +1,6 @@
 import { z } from "zod"
 import {
+  EMAIL_MAX_LENGTH,
   IdSchema,
   ISODateSchema,
   OrganizationMemberRoleSchema,
@@ -37,6 +38,7 @@ export type { OrganizationMemberRole, OrgVerificationKind, OrgVerificationStatus
 export const MAX_ORG_NAME = 120
 export const MAX_ORG_DESCRIPTION = 2000
 export const MAX_ORG_VERIFICATION_DOCUMENTS = 10
+export const MAX_ORG_VERIFICATION_NOTE = 1000
 export const MAX_ORG_INVITES_PER_ORG = 50
 export const ORG_SLUG_MIN = 3
 export const ORG_SLUG_MAX = 40
@@ -130,7 +132,7 @@ export const InviteOrganizationMemberRequestSchema = z
   .object({
     id: IdSchema,
     identifierKind: OrgInviteIdentifierKindSchema,
-    identifier: z.string().trim().min(1).max(254),
+    identifier: z.string().trim().min(1).max(EMAIL_MAX_LENGTH),
     role: OrganizationInviteRoleSchema,
   })
   .strict()
@@ -302,7 +304,7 @@ export const ApplyOrganizationVerificationRequestSchema = z
       .nullable()
       .optional(),
     documents: z.array(OrgVerificationDocumentSchema).max(MAX_ORG_VERIFICATION_DOCUMENTS).default([]),
-    note: z.string().max(1000).nullable().optional(),
+    note: z.string().max(MAX_ORG_VERIFICATION_NOTE).nullable().optional(),
   })
   .strict()
 export type ApplyOrganizationVerificationRequest = z.infer<
diff --git a/packages/shared/src/schemas/host/questions.ts b/packages/shared/src/schemas/host/questions.ts
index 9bd3d7fc..6a8b25b9 100644
--- a/packages/shared/src/schemas/host/questions.ts
+++ b/packages/shared/src/schemas/host/questions.ts
@@ -13,7 +13,8 @@ export const MAX_QUESTION_OPTIONS = 30
 export const MAX_QUESTION_OPTION_LABEL = 120
 export const MAX_SHORT_TEXT_ANSWER = 200
 export const MAX_LONG_TEXT_ANSWER = 2000
-const MAX_QUESTION_OPTION_VALUE = 80
+export const MAX_QUESTION_OPTION_VALUE = 80
+export const MAX_CONSENT_TEXT = 2000
 
 export const EventQuestionOptionSchema = z
   .object({
@@ -64,7 +65,7 @@ const EventQuestionDefUnionSchema = z.discriminatedUnion("kind", [
     .object({
       ...EventQuestionCommonFields,
       kind: z.literal("consent"),
-      consentText: z.string().trim().min(1).max(2000),
+      consentText: z.string().trim().min(1).max(MAX_CONSENT_TEXT),
     })
     .strict(),
 ])
diff --git a/packages/shared/src/schemas/host/registrations.ts b/packages/shared/src/schemas/host/registrations.ts
index 4176f50a..f602fcb1 100644
--- a/packages/shared/src/schemas/host/registrations.ts
+++ b/packages/shared/src/schemas/host/registrations.ts
@@ -194,6 +194,9 @@ export const CreateWalkupRegistrationRequestSchema = z
     name: z.string().trim().min(1).max(MAX_ATTENDEE_NAME),
     partySize: z.number().int().min(1).max(MAX_PARTY_SIZE).default(1),
     checkInNow: z.boolean().default(true),
+    // Without it the backend derives a key from the name and the minute, which merges two same-name
+    // walk-ups and splits one double-tap across a minute boundary.
+    idempotencyKey: IdempotencyKeySchema.optional(),
   })
   .strict()
 export type CreateWalkupRegistrationRequest = z.infer<typeof CreateWalkupRegistrationRequestSchema>
diff --git a/packages/shared/src/schemas/host/team.ts b/packages/shared/src/schemas/host/team.ts
index 44cfe00a..401a52e8 100644
--- a/packages/shared/src/schemas/host/team.ts
+++ b/packages/shared/src/schemas/host/team.ts
@@ -1,6 +1,7 @@
 import { z } from "zod"
 import {
   CleanupMemberRoleSchema,
+  EMAIL_MAX_LENGTH,
   IdSchema,
   ISODateSchema,
   pageResponse,
@@ -71,7 +72,7 @@ export const InviteEventTeamMemberRequestSchema = z
   .object({
     id: IdSchema,
     identifierKind: EventTeamInviteIdentifierKindSchema,
-    identifier: z.string().trim().min(1).max(254),
+    identifier: z.string().trim().min(1).max(EMAIL_MAX_LENGTH),
     role: EventTeamRoleSchema,
   })
   .strict()
diff --git a/packages/shared/src/schemas/internal-fields.ts b/packages/shared/src/schemas/internal-fields.ts
index d9e55f65..91645201 100644
--- a/packages/shared/src/schemas/internal-fields.ts
+++ b/packages/shared/src/schemas/internal-fields.ts
@@ -19,8 +19,9 @@ export const MAX_MENTIONED_USERS = 20
 const MAX_SORT_ORDER = 1000
 const IDEMPOTENCY_KEY_MIN_LENGTH = 8
 const IDEMPOTENCY_KEY_MAX_LENGTH = 128
-const MAX_REPORT_MEDIA_UPLOADS = 5
-
+export const MAX_REPORT_MEDIA = 5
+export const MAX_REPORT_TITLE_LENGTH = 120
+export const MAX_REPORT_DESCRIPTION_LENGTH = 2000
 export const MAX_REPORT_ADDR_LENGTH = 300
 
 // Coerced because list endpoints validate a GET query string, where every value arrives as a string.
@@ -50,8 +51,8 @@ export const ReportContentFields = {
   category: ReportCategorySchema,
   type: ReportTypeSchema,
   // A photo-only report omits the title and reads as the category label.
-  title: z.string().max(120).optional(),
-  description: z.string().max(2000).optional(),
+  title: z.string().max(MAX_REPORT_TITLE_LENGTH).optional(),
+  description: z.string().max(MAX_REPORT_DESCRIPTION_LENGTH).optional(),
   // Display label only; lat/lng stays canonical. Without it the operator console falls back to the
   // jurisdiction.
   addr: z.string().max(MAX_REPORT_ADDR_LENGTH).optional(),
@@ -60,7 +61,7 @@ export const ReportContentFields = {
 } as const
 
 export const ReportMediaAndHoneypotFields = {
-  mediaUploadIds: z.array(IdSchema).max(MAX_REPORT_MEDIA_UPLOADS),
+  mediaUploadIds: z.array(IdSchema).max(MAX_REPORT_MEDIA),
   // Anti-spam honeypot: empty or absent for a legitimate submission.
   honeypot: z.string().optional(),
 } as const
diff --git a/packages/shared/src/schemas/posts.ts b/packages/shared/src/schemas/posts.ts
index b046ea74..d38c7d96 100644
--- a/packages/shared/src/schemas/posts.ts
+++ b/packages/shared/src/schemas/posts.ts
@@ -8,15 +8,19 @@ import { MAX_MENTIONED_USERS, OkResponseSchema } from "./internal-fields.js"
  * contained there.
  */
 
+export const POST_BODY_MAX = 2000
+
 /**
  * Body of POST /posts, which also carries quotes and replies. A pure repost is not this route: it is
- * the toggle POST /posts/:id/repost. A quote requires repostOfId, a reply requires replyToId, every
- * post needs a body, an attachment or media, and organizationId is refused on a repost.
+ * the toggle POST /posts/:id/repost. `kind: "repost"` still parses here because narrowing PostKindSchema
+ * would change the published input type, but the server refuses it with a VALIDATION error; the
+ * organizationId refine below therefore only fires on a request the server would reject anyway. A quote
+ * requires repostOfId, a reply requires replyToId, and every post needs a body, an attachment or media.
  */
 export const PostComposeInputSchema = z
   .object({
     kind: PostKindSchema.default("post"),
-    body: z.string().trim().max(2000).optional(),
+    body: z.string().trim().max(POST_BODY_MAX).optional(),
     replyToId: IdSchema.optional(),
     repostOfId: IdSchema.optional(),
     eventId: IdSchema.optional(), // the server refuses an event the author neither hosts nor attends
@@ -127,9 +131,11 @@ export function parseFeedScoreCursor(cursor: string | null | undefined): FeedSco
   if (typeof cursor !== "string") return null
   const match = FEED_SCORE_CURSOR_RE.exec(cursor.trim())
   if (!match) return null
+  // Post ids are stored lowercase and isAfterFeedScoreCursor compares them as strings, so an uppercase
+  // id from a hand-edited or foreign cursor would order against the wrong rows.
   const parsed = FeedScoreCursorSchema.safeParse({
     score: Number(match[1]),
-    postId: match[2],
+    postId: match[2]?.toLowerCase(),
   })
   return parsed.success ? parsed.data : null
 }
diff --git a/packages/shared/src/schemas/reports.ts b/packages/shared/src/schemas/reports.ts
index b935b154..391f11f5 100644
--- a/packages/shared/src/schemas/reports.ts
+++ b/packages/shared/src/schemas/reports.ts
@@ -27,7 +27,12 @@ export type {
   MediaDTO,
 } from "./entities.js"
 
-export { MAX_REPORT_ADDR_LENGTH } from "./internal-fields.js"
+export {
+  MAX_REPORT_ADDR_LENGTH,
+  MAX_REPORT_DESCRIPTION_LENGTH,
+  MAX_REPORT_MEDIA,
+  MAX_REPORT_TITLE_LENGTH,
+} from "./internal-fields.js"
 
 export const CreateReportRequestSchema = z
   .object({
@@ -51,7 +56,8 @@ export type ListReportsInBBoxRequest = z.infer<typeof ListReportsInBBoxRequestSc
 
 export const ListReportsSearchRequestSchema = z
   .object({
-    // Optional so a category-only (or empty) search is valid.
+    // The server matches title and address, not description. Optional so a category-only (or empty)
+    // search is valid.
     q: z.string().trim().max(120).optional(),
     categories: z.array(ReportCategorySchema).optional(),
     types: z.array(ReportTypeSchema).optional(),
diff --git a/packages/shared/src/schemas/social.ts b/packages/shared/src/schemas/social.ts
index b265397f..5e5211b6 100644
--- a/packages/shared/src/schemas/social.ts
+++ b/packages/shared/src/schemas/social.ts
@@ -8,7 +8,7 @@ import {
   HttpsUrlSchema,
   SocialLinksSchema,
 } from "./entities.js"
-import { UserDTOSchema, LocaleEnum } from "./auth.js"
+import { EMAIL_OTP_CODE_LENGTH, UserDTOSchema, SupportedLocaleSchema } from "./auth.js"
 
 
 export { PersonDTOSchema } from "./entities.js"
@@ -67,18 +67,21 @@ export const ProfileEventsResponseSchema = pageResponse(CleanupDTOSchema)
 export type ProfileEventsResponse = z.infer<typeof ProfileEventsResponseSchema>
 
 
-export const HANDLE_REGEX = /^[a-zA-Z0-9_]{3,20}$/
+const HANDLE_MIN_LENGTH = 3
+export const HANDLE_MAX_LENGTH = 20
+export const HANDLE_REGEX = new RegExp(`^[a-zA-Z0-9_]{${HANDLE_MIN_LENGTH},${HANDLE_MAX_LENGTH}}$`)
 export function isValidHandle(handle: string): boolean {
   return HANDLE_REGEX.test(handle.trim())
 }
 export const HandleSchema = z.string().trim().regex(HANDLE_REGEX)
 
 export const MAX_BIO_LENGTH = 500
+export const DISPLAY_NAME_MAX_LENGTH = 80
 
 export const UpdateProfileRequestSchema = z
   .object({
     handle: HandleSchema,
-    displayName: z.string().trim().min(1).max(80),
+    displayName: z.string().trim().min(1).max(DISPLAY_NAME_MAX_LENGTH),
     bio: z.string().trim().max(MAX_BIO_LENGTH).nullable().optional(),
     avatarUploadId: IdSchema.optional(),
     socialLinks: SocialLinksSchema.nullable().optional(),
@@ -151,7 +154,7 @@ export type MentionSearchRequest = z.infer<typeof MentionSearchRequestSchema>
 export const UpdateSettingsRequestSchema = z
   .object({
     allowDirectMessages: z.boolean().optional(),
-    locale: LocaleEnum.optional(),
+    locale: SupportedLocaleSchema.optional(),
     // Defaults to true server-side. When false the public profile omits volunteerHours and the
     // per-event breakdown, and the user drops off the jurisdiction leaderboard; the owner still sees them.
     showVolunteerHours: z.boolean().optional(),
@@ -170,7 +173,7 @@ export type UpdateSettingsResponse = z.infer<typeof UpdateSettingsResponseSchema
 
 export const DeleteAccountRequestSchema = z
   .object({
-    emailOtp: z.string().regex(/^\d{6}$/),
+    emailOtp: z.string().regex(new RegExp(`^\\d{${EMAIL_OTP_CODE_LENGTH}}$`)),
   })
   .strict()
 export type DeleteAccountRequest = z.infer<typeof DeleteAccountRequestSchema>
diff --git a/packages/shared/src/schemas/volunteer.ts b/packages/shared/src/schemas/volunteer.ts
index 971eb951..42635326 100644
--- a/packages/shared/src/schemas/volunteer.ts
+++ b/packages/shared/src/schemas/volunteer.ts
@@ -9,20 +9,14 @@ import {
 
 /**
  * `"report"` is historical only and must stay in this list. Nothing writes a report credit any more
- * (filing a report is not volunteer service), but old ledger rows, the frozen `snapshot` of every
- * already-issued certificate, and older servers still carry the value, so dropping it would make those
- * payloads fail to parse. Do not add a new source that credits reports.
+ * (filing a report is not volunteer service), but old ledger rows (0.1 hours each), the frozen
+ * `snapshot` of every already-issued certificate, and older servers still carry the value, so dropping
+ * it would make those payloads fail to parse. Do not add a new source that credits reports.
  */
 export const VOLUNTEER_HOURS_SOURCES = ["report", "event", "manual"] as const
 export const VolunteerHoursSourceSchema = z.enum(VOLUNTEER_HOURS_SOURCES)
 export type VolunteerHoursSource = z.infer<typeof VolunteerHoursSourceSchema>
 
-/**
- * @deprecated Filing a report is not volunteer service and nothing credits it. The constant only
- * documents what the historical `source='report'` rows are worth; crediting anything with it would put
- * report filings back on the public leaderboard and on signed PDF transcripts.
- */
-export const REPORT_VOLUNTEER_HOURS = 0.1
 /** Smallest creditable event-hours amount (2-dp minimum; rounding is enforced backend-side). */
 export const MIN_EVENT_HOURS = 0.01
 export const MAX_EVENT_HOURS = 24
@@ -139,6 +133,8 @@ export type PublicVolunteerHoursResponse = z.infer<typeof PublicVolunteerHoursRe
 export { LeaderboardEntryDTOSchema, OrgHoursDTOSchema } from "./entities.js"
 export type { LeaderboardEntryDTO, OrgHoursDTO } from "./entities.js"
 
+export const MAX_LEADERBOARD_OFFSET = 500
+
 /**
  * `geoid` consumes the `:geoid` path param, so the route must merge it into the query before parsing
  * (request.query never contains it, and the key is required).
@@ -146,7 +142,7 @@ export type { LeaderboardEntryDTO, OrgHoursDTO } from "./entities.js"
 export const LeaderboardQuerySchema = z.object({
   geoid: z.string().min(1).max(64),
   limit: PageLimitSchema,
-  offset: z.coerce.number().int().nonnegative().max(500).optional(),
+  offset: z.coerce.number().int().nonnegative().max(MAX_LEADERBOARD_OFFSET).optional(),
 })
 export type LeaderboardQuery = z.infer<typeof LeaderboardQuerySchema>
 
diff --git a/packages/shared/src/time-units.ts b/packages/shared/src/time-units.ts
new file mode 100644
index 00000000..398db902
--- /dev/null
+++ b/packages/shared/src/time-units.ts
@@ -0,0 +1,9 @@
+export const MS_PER_SECOND = 1000
+export const SECONDS_PER_MINUTE = 60
+export const MINUTES_PER_HOUR = 60
+export const SECONDS_PER_HOUR = SECONDS_PER_MINUTE * MINUTES_PER_HOUR
+export const SECONDS_PER_DAY = 24 * SECONDS_PER_HOUR
+export const MS_PER_MINUTE = SECONDS_PER_MINUTE * MS_PER_SECOND
+export const MS_PER_HOUR = MINUTES_PER_HOUR * MS_PER_MINUTE
+export const MS_PER_DAY = 24 * MS_PER_HOUR
+export const MS_PER_WEEK = 7 * MS_PER_DAY
diff --git a/packages/shared/src/tokens/__tests__/chip-contrast.test.ts b/packages/shared/src/tokens/__tests__/chip-contrast.test.ts
index 5a332904..25b8cb7b 100644
--- a/packages/shared/src/tokens/__tests__/chip-contrast.test.ts
+++ b/packages/shared/src/tokens/__tests__/chip-contrast.test.ts
@@ -4,9 +4,7 @@ import {
   CHIP_HUE_NAMES,
   MIN_CHIP_RATIO,
   chipHuePairs,
-  chipPairPasses,
   contrastRatio,
-  mixWithWhite,
   relativeLuminance,
 } from "../chip-contrast.js"
 
@@ -24,14 +22,6 @@ describe("contrast math", () => {
     expect(contrastRatio("#356291", "#E9F1FA")).toBeCloseTo(contrastRatio("#E9F1FA", "#356291"), 12)
   })
 
-  it("mixes toward white and clamps the weight", () => {
-    expect(mixWithWhite("#000000", 1)).toBe("#000000")
-    expect(mixWithWhite("#000000", 0)).toBe("#FFFFFF")
-    expect(mixWithWhite("#000000", 0.5)).toBe("#808080")
-    expect(mixWithWhite("#000000", 5)).toBe("#000000")
-    expect(mixWithWhite("#000000", -5)).toBe("#FFFFFF")
-  })
-
   it("refuses a malformed hex instead of silently scoring garbage", () => {
     expect(() => relativeLuminance("#FFF")).toThrow(RangeError)
     expect(() => contrastRatio("nope", "#FFFFFF")).toThrow(RangeError)
@@ -41,7 +31,6 @@ describe("contrast math", () => {
     expect(() => relativeLuminance("#1G2233")).toThrow(RangeError)
     expect(() => relativeLuminance("#11223Z")).toThrow(RangeError)
     expect(() => relativeLuminance("12#3456")).toThrow(RangeError)
-    expect(() => mixWithWhite("#-12233", 0.5)).toThrow(RangeError)
     expect(relativeLuminance("ffffff")).toBeCloseTo(1, 10)
   })
 })
@@ -68,7 +57,6 @@ describe("chipHuePairs", () => {
           ratio,
           `${scheme} ${pair.name} chip ink ${pair.text} on ${pair.bg} is ${ratio.toFixed(2)}:1`,
         ).toBeGreaterThanOrEqual(MIN_CHIP_RATIO)
-        expect(chipPairPasses(pair)).toBe(true)
       }
     }
   })
diff --git a/packages/shared/src/tokens/chip-contrast.ts b/packages/shared/src/tokens/chip-contrast.ts
index da0ae4ad..c8f1f2d8 100644
--- a/packages/shared/src/tokens/chip-contrast.ts
+++ b/packages/shared/src/tokens/chip-contrast.ts
@@ -36,12 +36,6 @@ export function contrastRatio(a: string, b: string): number {
   return (Math.max(la, lb) + 0.05) / (Math.min(la, lb) + 0.05)
 }
 
-export function mixWithWhite(hex: string, colorWeight: number): string {
-  const weight = Math.min(1, Math.max(0, colorWeight))
-  const mixed = channels(hex).map((value) => Math.round(weight * value + (1 - weight) * 255))
-  return `#${mixed.map((c) => c.toString(16).padStart(2, "0")).join("").toUpperCase()}`
-}
-
 export function chipHuePairs(scheme: ColorSchemeName): readonly ChipHuePair[] {
   const palette = colorSchemes[scheme]
   return CHIP_HUE_NAMES.map((name) => ({
@@ -51,7 +45,3 @@ export function chipHuePairs(scheme: ColorSchemeName): readonly ChipHuePair[] {
     minRatio: MIN_CHIP_RATIO,
   }))
 }
-
-export function chipPairPasses(pair: ChipHuePair): boolean {
-  return contrastRatio(pair.text, pair.bg) >= pair.minRatio
-}
diff --git a/packages/shared/src/types/errors.ts b/packages/shared/src/types/errors.ts
index 5582450e..cf4a5303 100644
--- a/packages/shared/src/types/errors.ts
+++ b/packages/shared/src/types/errors.ts
@@ -55,7 +55,7 @@ export class AppError extends Error {
     this.httpStatus = opts.httpStatus ?? ERROR_HTTP_STATUS[code]
     if (opts.fields !== undefined) this.fields = opts.fields
     if (opts.requestId !== undefined) this.requestId = opts.requestId
-    Object.setPrototypeOf(this, AppError.prototype)
+    Object.setPrototypeOf(this, new.target.prototype)
   }
 
   toJSON(): {
@@ -152,7 +152,6 @@ export class MailSendError extends AppError {
     super(code, message, opts)
     this.name = "MailSendError"
     this.smtp = smtp
-    Object.setPrototypeOf(this, MailSendError.prototype)
   }
 }
 
@@ -166,14 +165,14 @@ export interface AppErrorLike {
 
 const ERROR_CODE_VALUES: ReadonlySet<string> = new Set<string>(Object.values(ErrorCode))
 
+export function isErrorCode(value: unknown): value is ErrorCode {
+  return typeof value === "string" && ERROR_CODE_VALUES.has(value)
+}
+
 export function isAppErrorLike(value: unknown): value is AppErrorLike {
   if (typeof value !== "object" || value === null) return false
   const candidate = value as { code?: unknown; message?: unknown }
-  return (
-    typeof candidate.code === "string" &&
-    ERROR_CODE_VALUES.has(candidate.code) &&
-    typeof candidate.message === "string"
-  )
+  return isErrorCode(candidate.code) && typeof candidate.message === "string"
 }
 
 function stringFields(fields: unknown): Record<string, string> | undefined {
@@ -184,13 +183,21 @@ function stringFields(fields: unknown): Record<string, string> | undefined {
   return named.length > 0 ? Object.fromEntries(named) : undefined
 }
 
-export function toAppError(value: unknown): AppError {
+export interface ToAppErrorOptions {
+  /** Message for a value that carries none of its own (an empty message, or a non-Error throw). */
+  fallbackMessage?: string
+}
+
+const UNKNOWN_ERROR_MESSAGE = "Unknown error"
+
+export function toAppError(value: unknown, opts: ToAppErrorOptions = {}): AppError {
   if (value instanceof AppError) return value
+  const fallbackMessage = opts.fallbackMessage ?? UNKNOWN_ERROR_MESSAGE
 
   if (isAppErrorLike(value)) {
     const { httpStatus, requestId } = value
     const fields = stringFields(value.fields)
-    return new AppError(value.code, value.message || "Unknown error", {
+    return new AppError(value.code, value.message || fallbackMessage, {
       ...(typeof httpStatus === "number" ? { httpStatus } : {}),
       ...(fields !== undefined ? { fields } : {}),
       ...(typeof requestId === "string" ? { requestId } : {}),
@@ -199,10 +206,10 @@ export function toAppError(value: unknown): AppError {
   }
 
   if (value instanceof Error) {
-    return new AppError(ErrorCode.INTERNAL, value.message || "Unknown error", { cause: value })
+    return new AppError(ErrorCode.INTERNAL, value.message || fallbackMessage, { cause: value })
   }
 
-  return new AppError(ErrorCode.INTERNAL, "Unknown error")
+  return new AppError(ErrorCode.INTERNAL, fallbackMessage)
 }
 
 /**
@@ -232,8 +239,8 @@ export function byErrorCode<Value>(
   table: ErrorCodeTable<Value>,
   fallback: Value,
 ): Value {
-  if (code === undefined || !ERROR_CODE_VALUES.has(code)) return fallback
-  const value = table[code as ErrorCode]
+  if (!isErrorCode(code)) return fallback
+  const value = table[code]
   return value === undefined ? fallback : value
 }
 
diff --git a/packages/shared/src/types/ws.ts b/packages/shared/src/types/ws.ts
index 91169b92..97981e30 100644
--- a/packages/shared/src/types/ws.ts
+++ b/packages/shared/src/types/ws.ts
@@ -2,6 +2,7 @@ import { z } from "zod"
 import { IdSchema, MESSAGE_BODY_MAX, RoomKindSchema } from "../schemas/common.js"
 import { ChatMessageDTOSchema, ChatMessageKindSchema } from "../schemas/entities.js"
 import { MAX_MENTIONED_USERS } from "../schemas/internal-fields.js"
+import type { ErrorCode } from "./errors.js"
 
 export { MESSAGE_BODY_MAX, RoomKindSchema } from "../schemas/common.js"
 export type { RoomKind } from "../schemas/common.js"
@@ -10,6 +11,24 @@ const MAX_MESSAGE_MEDIA_UPLOADS = 5
 
 export const EDIT_WINDOW_HOURS = 48
 
+export const WS_CLIENT_ID_MAX = 64
+
+// Frame codes the socket sends beyond ErrorCode. The lowercase ones are AppError `fields.code` subcodes
+// the server forwards as the frame code.
+export const WsErrorCode = {
+  BAD_FRAME: "BAD_FRAME",
+  BLOCKED: "BLOCKED",
+  CHANNEL_READ_ONLY: "channel_read_only",
+  REPLY_WRONG_ROOM: "reply_wrong_room",
+  REPLY_DELETED_TARGET: "reply_deleted_target",
+} as const
+export type WsErrorCode = (typeof WsErrorCode)[keyof typeof WsErrorCode]
+
+// Still any string on the wire: the server forwards unlisted AppError subcodes, and an older client must
+// keep parsing a code added later. `string & {}` keeps the known codes visible to editors.
+export type WsErrorFrameCode = `${ErrorCode}` | WsErrorCode | (string & {})
+const WsErrorFrameCodeSchema: z.ZodType<WsErrorFrameCode, z.ZodStringDef, string> = z.string()
+
 export const SignalTopicSchema = z.enum([
   "notifications",
   "threads",
@@ -33,7 +52,7 @@ export const WsClientMessageSchema = z.discriminatedUnion("type", [
     type: z.literal("send"),
     cleanupId: IdSchema,
     roomKind: RoomKindSchema.optional(),
-    clientId: z.string().min(1).max(64),
+    clientId: z.string().min(1).max(WS_CLIENT_ID_MAX),
     body: z.string().max(MESSAGE_BODY_MAX),
     kind: ChatMessageKindSchema.optional(),
     mentionedUserIds: z.array(IdSchema).max(MAX_MENTIONED_USERS).optional(),
@@ -93,7 +112,7 @@ export const WsServerMessageSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal("ack"), clientId: z.string(), message: ChatMessageDTOSchema }),
   z.object({
     type: z.literal("error"),
-    code: z.string(),
+    code: WsErrorFrameCodeSchema,
     message: z.string(),
     cleanupId: IdSchema.optional(),
     roomKind: RoomKindSchema.optional(),
diff --git a/packages/shared/src/url.ts b/packages/shared/src/url.ts
new file mode 100644
index 00000000..05515dca
--- /dev/null
+++ b/packages/shared/src/url.ts
@@ -0,0 +1,5 @@
+const TRAILING_SLASHES = /\/+$/
+
+export function stripTrailingSlashes(value: string): string {
+  return value.replace(TRAILING_SLASHES, "")
+}
diff --git a/packages/shared/src/uuid.ts b/packages/shared/src/uuid.ts
new file mode 100644
index 00000000..47b48cf5
--- /dev/null
+++ b/packages/shared/src/uuid.ts
@@ -0,0 +1,7 @@
+// Same shape and case-insensitivity as zod's `.uuid()` behind IdSchema and the backend's cursor check,
+// so a value this accepts is one IdSchema accepts.
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+export function isUuid(value: string): boolean {
+  return UUID_PATTERN.test(value)
+}
diff --git a/packages/ui/src/bodies/CleanupForm.tsx b/packages/ui/src/bodies/CleanupForm.tsx
index f9450dd9..aef6e2d9 100644
--- a/packages/ui/src/bodies/CleanupForm.tsx
+++ b/packages/ui/src/bodies/CleanupForm.tsx
@@ -3,6 +3,8 @@ import { ActivityIndicator, View, Image, Pressable, StyleSheet } from "react-nat
 import {
   EVENT_KIND_VALUES,
   MAX_EVENT_ADDRESS_LENGTH,
+  MAX_EVENT_DESCRIPTION,
+  MAX_EVENT_TITLE,
   MIN_EVENT_DURATION_MINUTES,
   type EventKind,
   type EventSlotDTO,
@@ -65,10 +67,6 @@ import {
 
 const COVER_RATIO = 16 / 9
 
-/** The create and update schemas' caps (`CreateCleanupRequest`), which export no named constant. */
-const EVENT_TITLE_MAX_LENGTH = 120
-const EVENT_DESCRIPTION_MAX_LENGTH = 2000
-
 export type CleanupFormSection = "basics" | "when" | "where" | "extras" | "share"
 
 const ALL_CLEANUP_FORM_SECTIONS: readonly CleanupFormSection[] = [
@@ -501,7 +499,7 @@ function BasicsSection({
         placeholder={t("field.titlePlaceholder")}
         value={value.title}
         onChangeText={(title) => patch({ title })}
-        maxLength={EVENT_TITLE_MAX_LENGTH}
+        maxLength={MAX_EVENT_TITLE}
       />
 
       <TextField
@@ -510,7 +508,7 @@ function BasicsSection({
         value={value.description}
         onChangeText={(description) => patch({ description })}
         multiline
-        maxLength={EVENT_DESCRIPTION_MAX_LENGTH}
+        maxLength={MAX_EVENT_DESCRIPTION}
       />
 
       <KindSelector value={value.eventKind} onChange={onChangeKind} />
diff --git a/packages/ui/src/bodies/DeleteAccountModal.tsx b/packages/ui/src/bodies/DeleteAccountModal.tsx
index e2aff612..a8ef4ef5 100644
--- a/packages/ui/src/bodies/DeleteAccountModal.tsx
+++ b/packages/ui/src/bodies/DeleteAccountModal.tsx
@@ -6,13 +6,11 @@ import { Text } from "../typography"
 import { ModalCardSheet, PrimaryButton, SecondaryButton } from "../primitives"
 import { MODAL_DISMISS_FOCUS_DELAY_MS } from "./modalFocusDelay"
 import { useRequestEmailCode, useDeleteAccount } from "../data"
-import { ErrorCode, errorCopyKey, type ErrorCodeTable } from "@civfix/shared"
+import { EMAIL_OTP_CODE_LENGTH, ErrorCode, errorCopyKey, type ErrorCodeTable } from "@civfix/shared"
 import { useT } from "../i18n"
 
 type TFn = (key: string, opts?: Record<string, unknown>) => string
 
-const EMAIL_OTP_LENGTH = 6
-
 export interface DeleteAccountModalProps {
   visible: boolean
   email: string | null | undefined
@@ -84,7 +82,7 @@ export function DeleteAccountModal({ visible, email, onClose }: DeleteAccountMod
   }
 
   const confirmDelete = () => {
-    if (code.length !== EMAIL_OTP_LENGTH || del.isPending) return
+    if (code.length !== EMAIL_OTP_CODE_LENGTH || del.isPending) return
     setError(null)
     del.mutate(
       { emailOtp: code },
@@ -130,7 +128,7 @@ export function DeleteAccountModal({ visible, email, onClose }: DeleteAccountMod
               variant="destructive"
               onPress={confirmDelete}
               loading={del.isPending}
-              disabled={code.length !== EMAIL_OTP_LENGTH}
+              disabled={code.length !== EMAIL_OTP_CODE_LENGTH}
               accessibilityLabel={t("a11y.deleteConfirm")}
             />
           </>
@@ -166,13 +164,13 @@ export function DeleteAccountModal({ visible, email, onClose }: DeleteAccountMod
           <TextInput
             ref={codeRef}
             value={code}
-            onChangeText={(txt) => setCode(txt.replace(/[^0-9]/g, "").slice(0, EMAIL_OTP_LENGTH))}
+            onChangeText={(txt) => setCode(txt.replace(/[^0-9]/g, "").slice(0, EMAIL_OTP_CODE_LENGTH))}
             editable={!del.isPending}
             keyboardType="number-pad"
             inputMode="numeric"
             textContentType="oneTimeCode"
             autoComplete="one-time-code"
-            maxLength={EMAIL_OTP_LENGTH}
+            maxLength={EMAIL_OTP_CODE_LENGTH}
             placeholder="000000"
             placeholderTextColor={th.colors.textSubtle}
             accessibilityLabel={t("a11y.verificationCode")}
diff --git a/packages/ui/src/bodies/GroupIdentityFields.tsx b/packages/ui/src/bodies/GroupIdentityFields.tsx
index e987c276..d6c0c681 100644
--- a/packages/ui/src/bodies/GroupIdentityFields.tsx
+++ b/packages/ui/src/bodies/GroupIdentityFields.tsx
@@ -4,7 +4,7 @@ import { makeThemedStyles, useTheme, focusRingProps } from "../theme"
 import { Text, Icon, iconMap } from "../typography"
 import { TextField } from "../primitives"
 import type { ComposerAttachments } from "../primitives/useComposerAttachments"
-import { GROUP_NAME_MAX, GROUP_DESCRIPTION_MAX } from "./groupWizard"
+import { CHAT_GROUP_DESCRIPTION_MAX, CHAT_GROUP_NAME_MAX } from "@civfix/shared"
 
 export interface GroupIdentityLabels {
   avatarA11y: string
@@ -90,7 +90,7 @@ export function GroupIdentityFields({
         placeholder={labels.namePlaceholder}
         value={name}
         onChangeText={onChangeName}
-        maxLength={GROUP_NAME_MAX}
+        maxLength={CHAT_GROUP_NAME_MAX}
         containerStyle={isSheet ? styles.fieldSheet : styles.field}
       />
       <TextField
@@ -98,7 +98,7 @@ export function GroupIdentityFields({
         placeholder={labels.descriptionPlaceholder}
         value={description}
         onChangeText={onChangeDescription}
-        maxLength={GROUP_DESCRIPTION_MAX}
+        maxLength={CHAT_GROUP_DESCRIPTION_MAX}
         multiline
         containerStyle={isSheet ? styles.fieldSheet : styles.field}
       />
diff --git a/packages/ui/src/bodies/__tests__/groupWizard.test.ts b/packages/ui/src/bodies/__tests__/groupWizard.test.ts
index 8235bb7e..600741e8 100644
--- a/packages/ui/src/bodies/__tests__/groupWizard.test.ts
+++ b/packages/ui/src/bodies/__tests__/groupWizard.test.ts
@@ -1,12 +1,11 @@
 import { describe, expect, it } from "vitest"
+import { CHAT_GROUP_DESCRIPTION_MAX, CHAT_GROUP_NAME_MAX } from "@civfix/shared"
 import type { DetailEntry } from "../../nav/types"
 import {
   canProceedToIdentity,
   canCreateGroup,
   normalizeGroupDraft,
   stackOpeningGroup,
-  GROUP_NAME_MAX,
-  GROUP_DESCRIPTION_MAX,
 } from "../groupWizard"
 
 describe("canProceedToIdentity (step 1 Next gate)", () => {
@@ -33,16 +32,16 @@ describe("canCreateGroup (step 2 Create gate)", () => {
   it("enables on any non-blank name within the cap", () => {
     expect(canCreateGroup("Block cleanup crew")).toBe(true)
     expect(canCreateGroup("  padded  ")).toBe(true)
-    expect(canCreateGroup("x".repeat(GROUP_NAME_MAX))).toBe(true)
+    expect(canCreateGroup("x".repeat(CHAT_GROUP_NAME_MAX))).toBe(true)
   })
 
   it("is disabled when the trimmed name exceeds the 80-char contract cap", () => {
-    expect(canCreateGroup("x".repeat(GROUP_NAME_MAX + 1))).toBe(false)
+    expect(canCreateGroup("x".repeat(CHAT_GROUP_NAME_MAX + 1))).toBe(false)
   })
 
   it("is disabled when the description exceeds the 500-char contract cap", () => {
-    expect(canCreateGroup("ok", "d".repeat(GROUP_DESCRIPTION_MAX))).toBe(true)
-    expect(canCreateGroup("ok", "d".repeat(GROUP_DESCRIPTION_MAX + 1))).toBe(false)
+    expect(canCreateGroup("ok", "d".repeat(CHAT_GROUP_DESCRIPTION_MAX))).toBe(true)
+    expect(canCreateGroup("ok", "d".repeat(CHAT_GROUP_DESCRIPTION_MAX + 1))).toBe(false)
   })
 })
 
diff --git a/packages/ui/src/bodies/calendarModel.ts b/packages/ui/src/bodies/calendarModel.ts
index 8941c349..244f28b5 100644
--- a/packages/ui/src/bodies/calendarModel.ts
+++ b/packages/ui/src/bodies/calendarModel.ts
@@ -1,4 +1,4 @@
-import { MIN_EVENT_DURATION_MINUTES } from "@civfix/shared"
+import { MIN_EVENT_DURATION_MINUTES, MS_PER_DAY, MS_PER_HOUR, MS_PER_MINUTE } from "@civfix/shared"
 import {
   wallClockExistsInZone,
   wallClockInZone,
@@ -6,7 +6,6 @@ import {
   zoneShortName,
   type WallClock,
 } from "@civfix/shared/datetime"
-import { DAY_MS } from "./timeUnits"
 
 export function startOfDay(d: Date): Date {
   const x = new Date(d)
@@ -22,7 +21,7 @@ export function sameDay(a: Date, b: Date): boolean {
   )
 }
 
-export const PAST_SCHEDULE_GRACE_MS = 60_000
+export const PAST_SCHEDULE_GRACE_MS = MS_PER_MINUTE
 
 export function mergeDateTime(date: Date, time: Date): Date {
   const merged = new Date(date)
@@ -52,17 +51,17 @@ export function isScheduleUntouched(
   const original = new Date(originalIso).getTime()
   if (Number.isNaN(original)) return false
   if (timeZone === undefined) return date.getTime() === original && time.getTime() === original
-  return formInstantMs(date, time, timeZone) === Math.floor(original / 60_000) * 60_000
+  return formInstantMs(date, time, timeZone) === Math.floor(original / MS_PER_MINUTE) * MS_PER_MINUTE
 }
 
-const MIN_EVENT_DURATION_MS = MIN_EVENT_DURATION_MINUTES * 60_000
+const MIN_EVENT_DURATION_MS = MIN_EVENT_DURATION_MINUTES * MS_PER_MINUTE
 
 export const DURATION_CHIP_HOURS = [1, 2, 3, 4] as const
 
 export type DurationChipHours = (typeof DURATION_CHIP_HOURS)[number]
 
 function clockOf(hours: number, minutes: number): number {
-  return hours * 3_600_000 + minutes * 60_000
+  return hours * MS_PER_HOUR + minutes * MS_PER_MINUTE
 }
 
 function clockMs(time: Date): number {
@@ -70,7 +69,7 @@ function clockMs(time: Date): number {
 }
 
 function offsetFromClocks(startClock: number, endClock: number): number {
-  return (((endClock - startClock) % DAY_MS) + DAY_MS) % DAY_MS
+  return (((endClock - startClock) % MS_PER_DAY) + MS_PER_DAY) % MS_PER_DAY
 }
 
 export function endOffsetMs(start: Date, end: Date): number {
@@ -90,7 +89,7 @@ export function resolveEventEnd(date: Date, start: Date, end: Date): Date {
 export function endTimeAfter(date: Date, start: Date, offsetMs: number): Date {
   const clock = offsetFromClocks(0, clockMs(start) + offsetMs)
   const day = new Date(date)
-  day.setHours(Math.floor(clock / 3_600_000), Math.floor((clock % 3_600_000) / 60_000), 0, 0)
+  day.setHours(Math.floor(clock / MS_PER_HOUR), Math.floor((clock % MS_PER_HOUR) / MS_PER_MINUTE), 0, 0)
   return day
 }
 
@@ -148,7 +147,7 @@ export function durationChipFor(
   if (!date || !start || !end) return null
   const elapsed = eventDurationMs(date, start, end, timeZone)
   if (elapsed <= 0) return null
-  return DURATION_CHIP_HOURS.find((h) => h * 3_600_000 === elapsed) ?? null
+  return DURATION_CHIP_HOURS.find((h) => h * MS_PER_HOUR === elapsed) ?? null
 }
 
 export function formWallClock(date: Date, time: Date): WallClock {
@@ -175,7 +174,7 @@ export function wallClockToFormDate(wallClock: WallClock): Date {
 
 export function addWallClockDays(wallClock: WallClock, days: number): WallClock {
   const anchor = new Date(Date.UTC(wallClock.year, wallClock.month - 1, wallClock.day, 12))
-  const moved = new Date(anchor.getTime() + days * DAY_MS)
+  const moved = new Date(anchor.getTime() + days * MS_PER_DAY)
   return {
     year: moved.getUTCFullYear(),
     month: moved.getUTCMonth() + 1,
@@ -276,7 +275,7 @@ export function makeZoneDisplayNameCache(): ZoneDisplayNameCache {
   const names = new Map<string, string>()
   return {
     get(timeZone, locale, now = Date.now()) {
-      const today = Math.floor(now / DAY_MS)
+      const today = Math.floor(now / MS_PER_DAY)
       if (today !== day) {
         names.clear()
         day = today
diff --git a/packages/ui/src/bodies/channelWizard.ts b/packages/ui/src/bodies/channelWizard.ts
index 1ed485c7..88c2535b 100644
--- a/packages/ui/src/bodies/channelWizard.ts
+++ b/packages/ui/src/bodies/channelWizard.ts
@@ -9,8 +9,9 @@
  *   3. "members"    - an OPTIONAL initial subscriber list. Create never looks at the count: a channel
  *                     with zero subscribers is valid (the owner broadcasts; people join later).
  *
- * Identity fields + caps live in groupWizard (GROUP_NAME_MAX / GROUP_DESCRIPTION_MAX / canCreateGroup /
- * normalizeGroupDraft), so both wizards mirror CreateChatGroupRequestSchema from one place.
+ * Identity fields + caps live in groupWizard (canCreateGroup / normalizeGroupDraft, over the contract's
+ * CHAT_GROUP_NAME_MAX / CHAT_GROUP_DESCRIPTION_MAX), so both wizards mirror CreateChatGroupRequestSchema
+ * from one place.
  */
 import { canCreateGroup } from "./groupWizard"
 
diff --git a/packages/ui/src/bodies/conversation/conversationModel.ts b/packages/ui/src/bodies/conversation/conversationModel.ts
index 90f459a3..e0ed0a88 100644
--- a/packages/ui/src/bodies/conversation/conversationModel.ts
+++ b/packages/ui/src/bodies/conversation/conversationModel.ts
@@ -1,5 +1,5 @@
 import { useMemo } from "react"
-import { AVATAR_PALETTE, ErrorCode, appErrorCode, avatarGradient, type ChatItem, type ChatMessageDTO, type MessageThreadDTO, type PersonDTO, type RoomKind } from "@civfix/shared"
+import { AVATAR_PALETTE, ErrorCode, WsErrorCode, appErrorCode, avatarGradient, type ChatItem, type ChatMessageDTO, type MessageThreadDTO, type PersonDTO, type RoomKind } from "@civfix/shared"
 import type { TFunction } from "i18next"
 import { useT } from "../../i18n"
 import { useThreadForRoom } from "../../data/hooks/chat"
@@ -77,13 +77,13 @@ export function getScrollableNode(
 }
 
 const TRANSIENT_ERROR_COPY_KEYS: Record<string, string> = {
-  RATE_LIMITED: "room_error.rate_limited",
-  BLOCKED: "room_error.blocked",
-  channel_read_only: "room_error.read_only",
-  reply_wrong_room: "room_error.reply_unavailable",
-  reply_deleted_target: "room_error.reply_unavailable",
-  BAD_FRAME: "room_error.send_rejected",
-  VALIDATION: "room_error.send_rejected",
+  [ErrorCode.RATE_LIMITED]: "room_error.rate_limited",
+  [WsErrorCode.BLOCKED]: "room_error.blocked",
+  [WsErrorCode.CHANNEL_READ_ONLY]: "room_error.read_only",
+  [WsErrorCode.REPLY_WRONG_ROOM]: "room_error.reply_unavailable",
+  [WsErrorCode.REPLY_DELETED_TARGET]: "room_error.reply_unavailable",
+  [WsErrorCode.BAD_FRAME]: "room_error.send_rejected",
+  [ErrorCode.VALIDATION]: "room_error.send_rejected",
 }
 
 export function transientErrorCopyKey(code: string): string {
diff --git a/packages/ui/src/bodies/feed/InlineComposer.tsx b/packages/ui/src/bodies/feed/InlineComposer.tsx
index b958e118..3165b845 100644
--- a/packages/ui/src/bodies/feed/InlineComposer.tsx
+++ b/packages/ui/src/bodies/feed/InlineComposer.tsx
@@ -7,6 +7,7 @@ import {
   type BlurEvent,
   type TextInput as RNTextInput,
 } from "react-native"
+import { POST_BODY_MAX } from "@civfix/shared"
 import { TextInput } from "../../primitives/TextInput"
 import { focusRingProps, makeThemedStyles, useTheme, webInputReset, MIN_TOUCH_TARGET } from "../../theme"
 import { Avatar, MentionAutocomplete } from "../../primitives"
@@ -16,7 +17,7 @@ import { useComposerAttachments } from "../../primitives/useComposerAttachments"
 import { Icon, Text, iconMap } from "../../typography"
 import { useMyProfile } from "../../data"
 import { useT } from "../../i18n"
-import { POST_BODY_MAX_LENGTH, activePostMentions, mergeMention } from "../postComposerModel"
+import { activePostMentions, mergeMention } from "../postComposerModel"
 import {
   POST_COMPOSER_MEDIA_CAP,
   carriedMediaIndex,
@@ -327,7 +328,7 @@ function InlineComposerForOwner() {
             placeholder={model.placeholder}
             placeholderTextColor={th.colors.textSubtle}
             multiline
-            maxLength={POST_BODY_MAX_LENGTH}
+            maxLength={POST_BODY_MAX}
             autoFocus
             style={[webInputReset, styles.input]}
           />
diff --git a/packages/ui/src/bodies/groupWizard.ts b/packages/ui/src/bodies/groupWizard.ts
index 31348286..fede9500 100644
--- a/packages/ui/src/bodies/groupWizard.ts
+++ b/packages/ui/src/bodies/groupWizard.ts
@@ -7,16 +7,11 @@
  *                   yourself is created implicitly by the server adding the creator as owner, but an
  *                   empty invite list is a dead room - the server contract allows it, the UX does not).
  *   2. "identity" - avatar / name / description. Create is gated on a non-blank name within the
- *                   contract's 80-char cap (the description cap is 500; enforced by maxLength + here).
+ *                   contract's name cap (the description cap is enforced by maxLength + here).
  */
-import type { ChatGroupDTO } from "@civfix/shared"
+import { CHAT_GROUP_DESCRIPTION_MAX, CHAT_GROUP_NAME_MAX, type ChatGroupDTO } from "@civfix/shared"
 import type { DetailEntry } from "../nav"
 
-/** Mirrors CreateChatGroupRequestSchema's `name: max(80)` (shared exports no named constant). */
-export const GROUP_NAME_MAX = 80
-/** Mirrors CreateChatGroupRequestSchema's `description: max(500)`. */
-export const GROUP_DESCRIPTION_MAX = 500
-
 export type GroupWizardStep = "members" | "identity"
 
 export function canProceedToIdentity(selectedCount: number): boolean {
@@ -27,8 +22,8 @@ export function canCreateGroup(name: string, description = ""): boolean {
   const trimmed = name.trim()
   return (
     trimmed.length >= 1 &&
-    trimmed.length <= GROUP_NAME_MAX &&
-    description.trim().length <= GROUP_DESCRIPTION_MAX
+    trimmed.length <= CHAT_GROUP_NAME_MAX &&
+    description.trim().length <= CHAT_GROUP_DESCRIPTION_MAX
   )
 }
 
diff --git a/packages/ui/src/bodies/host/OrgManageBody.tsx b/packages/ui/src/bodies/host/OrgManageBody.tsx
index 7435e36c..1fa46cbb 100644
--- a/packages/ui/src/bodies/host/OrgManageBody.tsx
+++ b/packages/ui/src/bodies/host/OrgManageBody.tsx
@@ -5,6 +5,7 @@ import {
   MAX_ORG_DESCRIPTION,
   MAX_ORG_NAME,
   SAFE_HTTPS_LINK_MAX,
+  SOCIAL_HANDLE_PREFIX,
   SOCIAL_PLATFORMS,
   SOCIAL_PLATFORM_LABELS,
 } from "@civfix/shared"
@@ -36,7 +37,6 @@ import { RowsSkeleton } from "./HostSkeletons"
 import { CollaboratorsSection } from "./dashboard/CollaboratorsSection"
 import { OrgField } from "./OrgField"
 import {
-  SOCIAL_PREFIX,
   canOpenOrgManage,
   linksDirty,
   linksDraftFrom,
@@ -323,7 +323,7 @@ export function OrgManageBody({ slug }: { slug: string }) {
               onChange={(next) => setLinks((c) => ({ ...c, [platform]: next }))}
               label={SOCIAL_PLATFORM_LABELS[platform]}
               max={socialHandleMax(platform)}
-              prefix={SOCIAL_PREFIX[platform]}
+              prefix={SOCIAL_HANDLE_PREFIX[platform]}
               error={problem("links", `socialLinks.${platform}`)}
             />
           ))}
diff --git a/packages/ui/src/bodies/host/__tests__/analyticsModel.test.ts b/packages/ui/src/bodies/host/__tests__/analyticsModel.test.ts
index 1c763a67..f4a0eb1c 100644
--- a/packages/ui/src/bodies/host/__tests__/analyticsModel.test.ts
+++ b/packages/ui/src/bodies/host/__tests__/analyticsModel.test.ts
@@ -27,7 +27,7 @@ import {
   wholeEventCheckedIn,
   wholeEventSignups,
 } from "../analyticsModel"
-import { DAY_MS } from "../../timeUnits"
+import { MS_PER_DAY } from "@civfix/shared"
 import { breakdownBars, seriesBars } from "../analytics/chartBars"
 import { EMPTY_VALUE } from "../../../i18n/emptyValue"
 
@@ -167,7 +167,7 @@ describe("slicing a series only ever drops points", () => {
   })
 
   it("returns an EMPTY series rather than silently falling back to the whole one", () => {
-    expect(rangeSlice(series, 1, now + 30 * DAY_MS)).toEqual([])
+    expect(rangeSlice(series, 1, now + 30 * MS_PER_DAY)).toEqual([])
   })
 
   it("passes the whole series through when there is no window to apply", () => {
diff --git a/packages/ui/src/bodies/host/__tests__/orgManageModel.test.ts b/packages/ui/src/bodies/host/__tests__/orgManageModel.test.ts
index 6436a24e..1ef63b12 100644
--- a/packages/ui/src/bodies/host/__tests__/orgManageModel.test.ts
+++ b/packages/ui/src/bodies/host/__tests__/orgManageModel.test.ts
@@ -1,8 +1,7 @@
 import { describe, expect, it } from "vitest"
 import type { OrganizationDTO, OrganizationMemberDTO } from "@civfix/shared"
-import { MAX_ORG_DESCRIPTION, MAX_ORG_NAME, SocialLinksSchema } from "@civfix/shared"
+import { MAX_ORG_DESCRIPTION, MAX_ORG_NAME, SOCIAL_HANDLE_PREFIX, SocialLinksSchema } from "@civfix/shared"
 import {
-  SOCIAL_PREFIX,
   canOpenOrgManage,
   counterVisible,
   lastAdminSeat,
@@ -96,7 +95,7 @@ describe("each section PATCHes only its own fields", () => {
   })
 
   it("names a prefix for every platform, so no field asks for a whole URL", () => {
-    expect(Object.keys(SOCIAL_PREFIX).sort()).toEqual(
+    expect(Object.keys(SOCIAL_HANDLE_PREFIX).sort()).toEqual(
       ["facebook", "instagram", "tiktok", "whatsapp", "x"],
     )
   })
diff --git a/packages/ui/src/bodies/host/analyticsModel.ts b/packages/ui/src/bodies/host/analyticsModel.ts
index 487ac005..f6b4a2a3 100644
--- a/packages/ui/src/bodies/host/analyticsModel.ts
+++ b/packages/ui/src/bodies/host/analyticsModel.ts
@@ -7,10 +7,9 @@ import type {
   SeriesPoint,
   SuppressedRate,
 } from "@civfix/shared"
-import { EVENT_ANALYTICS_COMPARISON_MIN_EVENTS } from "@civfix/shared"
+import { EVENT_ANALYTICS_COMPARISON_MIN_EVENTS, MS_PER_DAY, isUuid } from "@civfix/shared"
 import { visibleValue } from "@civfix/shared/host"
 import { hasHostCapability } from "../../data/hooks/host"
-import { DAY_MS } from "../timeUnits"
 import { dedupeById } from "../../primitives/listKeys"
 
 export const SUMMARY_PANELS = ["signups", "checkins", "hours", "impact"] as const
@@ -53,7 +52,7 @@ export function rangeSlice(
   now: number,
 ): readonly SeriesPoint[] {
   if (days === null || days <= 0) return points
-  const from = Math.floor(now / DAY_MS) * DAY_MS - (days - 1) * DAY_MS
+  const from = Math.floor(now / MS_PER_DAY) * MS_PER_DAY - (days - 1) * MS_PER_DAY
   return points.filter((point) => {
     const at = parse(point.day)
     return at === null ? true : at >= from
@@ -135,10 +134,8 @@ export function pickerOptions(
     .map((event) => ({ id: event.id, title: event.title }))
 }
 
-const EVENT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
-
 export function isEventId(key: string): boolean {
-  return EVENT_ID.test(key)
+  return isUuid(key)
 }
 
 export function eventRowTarget(
diff --git a/packages/ui/src/bodies/host/dashboard/dashboardModel.ts b/packages/ui/src/bodies/host/dashboard/dashboardModel.ts
index f991ed51..53ee4141 100644
--- a/packages/ui/src/bodies/host/dashboard/dashboardModel.ts
+++ b/packages/ui/src/bodies/host/dashboard/dashboardModel.ts
@@ -12,13 +12,12 @@ import type {
   OrganizationMemberRole,
   OrgInviteIdentifierKind,
 } from "@civfix/shared"
-import { ErrorCode, MAX_ORG_INVITES_PER_ORG, byErrorCode, type ErrorCodeTable } from "@civfix/shared"
+import { ErrorCode, MAX_ORG_INVITES_PER_ORG, MS_PER_DAY, byErrorCode, type ErrorCodeTable } from "@civfix/shared"
 import type { EventWhenInput } from "@civfix/shared/datetime"
 import { wallClockInZone, wallClockToInstantMs, type WallClock } from "@civfix/shared/datetime"
 import { can, deriveCleanupStatus, eventPhase, type EventWindowLike } from "@civfix/shared/host"
 import { addWallClockDays, formInstantMs } from "../../calendarModel"
 import { viewerTimeZone } from "../../../i18n"
-import { DAY_MS } from "../../timeUnits"
 import { hasHostCapability } from "../../../data/hooks/host"
 import {
   hasActions,
@@ -267,9 +266,9 @@ export function nextDuplicateStart(
 ): DuplicateStartSeed {
   const zone = timezone ?? viewerTimeZone()
   const parsed = Date.parse(startsAt)
-  const seed = Number.isNaN(parsed) ? now.getTime() + 7 * DAY_MS : parsed
+  const seed = Number.isNaN(parsed) ? now.getTime() + 7 * MS_PER_DAY : parsed
   const behindMs = now.getTime() - seed
-  const weeks = behindMs > 0 ? Math.ceil(behindMs / (7 * DAY_MS)) : 0
+  const weeks = behindMs > 0 ? Math.ceil(behindMs / (7 * MS_PER_DAY)) : 0
   let wallClock = addWallClockDays(wallClockInZone(seed, zone), weeks * 7)
 
   for (let roll = 0; roll < MAX_DUPLICATE_ROLLS; roll++) {
@@ -281,7 +280,7 @@ export function nextDuplicateStart(
         : addWallClockDays(wallClock, 7)
   }
 
-  const fallback = now.getTime() + 7 * DAY_MS
+  const fallback = now.getTime() + 7 * MS_PER_DAY
   return { instantMs: fallback, wallClock: wallClockInZone(fallback, zone) }
 }
 
diff --git a/packages/ui/src/bodies/host/hostTeamModel.ts b/packages/ui/src/bodies/host/hostTeamModel.ts
index 1cea4594..3a266033 100644
--- a/packages/ui/src/bodies/host/hostTeamModel.ts
+++ b/packages/ui/src/bodies/host/hostTeamModel.ts
@@ -6,13 +6,14 @@ import type {
   EventTeamMemberDTO,
 } from "@civfix/shared"
 import {
+  EMAIL_MAX_LENGTH,
   ErrorCode,
   MAX_TEAM_INVITES_PER_EVENT,
   byErrorCode,
   isValidHandle,
   type ErrorCodeTable,
 } from "@civfix/shared"
-import { GUEST_EMAIL_MAX, guestEmailValue } from "./registration/guestRsvpModel"
+import { guestEmailValue } from "./registration/guestRsvpModel"
 import { settableRolesOtherThan, type SettableEventMemberRole } from "../../data/eventTeamTiers"
 import {
   hasActions,
@@ -30,7 +31,7 @@ export const TEAM_MEMBER_ROLE_ORDER: readonly CleanupMemberRole[] = [
   "member",
 ]
 
-export const INVITE_IDENTIFIER_MAX = GUEST_EMAIL_MAX
+export const INVITE_IDENTIFIER_MAX = EMAIL_MAX_LENGTH
 
 export function teamMemberRank(role: CleanupMemberRole): number {
   return rankIn(TEAM_MEMBER_ROLE_ORDER, role)
diff --git a/packages/ui/src/bodies/host/orgManageModel.ts b/packages/ui/src/bodies/host/orgManageModel.ts
index 9c60bf54..681ba4ff 100644
--- a/packages/ui/src/bodies/host/orgManageModel.ts
+++ b/packages/ui/src/bodies/host/orgManageModel.ts
@@ -7,22 +7,18 @@ import type {
 } from "@civfix/shared"
 import {
   ErrorCode,
+  SOCIAL_HANDLE_MAX_LENGTH,
   SOCIAL_PLATFORMS,
   SafeHttpsLinkSchema,
   SocialLinksSchema,
   UpdateOrganizationRequestSchema,
+  WHATSAPP_NUMBER_MAX_LENGTH,
   byErrorCode,
   type ErrorCodeTable,
 } from "@civfix/shared"
 
 const ORG_COUNTER_AT = 0.9
 
-// Mirrors the length caps in SocialLinksSchema's handle and WhatsApp regexes, which the contract does
-// not export as constants.
-const SOCIAL_HANDLE_MAX = 30
-
-const WHATSAPP_NUMBER_MAX = 15
-
 // UpdateOrganizationRequestSchema requires a uuid id; profile validation only reads the name and
 // description issues, so any well-formed id stands in.
 const VALIDATION_PLACEHOLDER_ID = "00000000-0000-4000-8000-000000000000"
@@ -148,16 +144,8 @@ export function linksErrors(draft: OrgLinksDraft): Record<string, string> {
   return out
 }
 
-export const SOCIAL_PREFIX: Readonly<Record<SocialPlatform, string>> = {
-  facebook: "facebook.com/",
-  instagram: "instagram.com/",
-  tiktok: "tiktok.com/@",
-  x: "x.com/",
-  whatsapp: "+",
-}
-
 export function socialHandleMax(platform: SocialPlatform): number {
-  return platform === "whatsapp" ? WHATSAPP_NUMBER_MAX : SOCIAL_HANDLE_MAX
+  return platform === "whatsapp" ? WHATSAPP_NUMBER_MAX_LENGTH : SOCIAL_HANDLE_MAX_LENGTH
 }
 
 export function counterVisible(length: number, max: number): boolean {
diff --git a/packages/ui/src/bodies/host/registration/GuestRsvpSheet.tsx b/packages/ui/src/bodies/host/registration/GuestRsvpSheet.tsx
index b1db5f51..2ed7217d 100644
--- a/packages/ui/src/bodies/host/registration/GuestRsvpSheet.tsx
+++ b/packages/ui/src/bodies/host/registration/GuestRsvpSheet.tsx
@@ -2,6 +2,7 @@ import React, { useCallback, useEffect, useMemo, useState } from "react"
 import { View, Pressable } from "react-native"
 import { TextInput } from "../../../primitives/TextInput"
 import {
+  EMAIL_MAX_LENGTH,
   MAX_GUEST_NAME,
   type EventAnswerValue,
   type EventQuestionDTO,
@@ -43,7 +44,6 @@ import { SecondaryButton } from "../../../primitives/SecondaryButton"
 import { SegmentedCodeInput } from "../../../primitives/SegmentedCodeInput"
 import { ModalCardSheet, modalSheetInputStyle } from "../../../primitives/ModalCardSheet"
 import {
-  GUEST_EMAIL_MAX,
   GUEST_RSVP_CODE_LENGTH,
   GUEST_RSVP_TURNSTILE_ACTION,
   RESEND_COUNTDOWN_TICK_MS,
@@ -510,10 +510,10 @@ export function GuestRsvpSheet({
             <TextInput
               value={form.email}
               onChangeText={(next) =>
-                setForm((prev) => ({ ...prev, email: next.slice(0, GUEST_EMAIL_MAX) }))
+                setForm((prev) => ({ ...prev, email: next.slice(0, EMAIL_MAX_LENGTH) }))
               }
               editable={!sendPending}
-              maxLength={GUEST_EMAIL_MAX}
+              maxLength={EMAIL_MAX_LENGTH}
               placeholder={t("form.email_placeholder")}
               placeholderTextColor={th.colors.textSubtle}
               accessibilityLabel={t("form.email_label")}
diff --git a/packages/ui/src/bodies/host/registration/guestRsvpModel.ts b/packages/ui/src/bodies/host/registration/guestRsvpModel.ts
index 91809eae..9d0db40e 100644
--- a/packages/ui/src/bodies/host/registration/guestRsvpModel.ts
+++ b/packages/ui/src/bodies/host/registration/guestRsvpModel.ts
@@ -1,4 +1,6 @@
 import {
+  EMAIL_MAX_LENGTH,
+  EMAIL_OTP_CODE_LENGTH,
   ErrorCode,
   GUEST_OTP_ERROR_FIELD,
   GUEST_RSVP_TURNSTILE_ACTION,
@@ -32,7 +34,7 @@ export function guestRsvpCommitFor(step: GuestRsvpStep, exhausted: boolean): Gue
   }
 }
 
-export const GUEST_RSVP_CODE_LENGTH = 6
+export const GUEST_RSVP_CODE_LENGTH = EMAIL_OTP_CODE_LENGTH
 
 export { GUEST_RSVP_TURNSTILE_ACTION }
 
@@ -40,8 +42,6 @@ const US_PHONE_E164 = /^\+1[2-9]\d{9}$/
 
 const EMAIL_SHAPE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 
-export const GUEST_EMAIL_MAX = 254
-
 export interface GuestRsvpFormState {
   name: string
   channel: GuestContactChannel
@@ -78,7 +78,7 @@ export function guestPhoneE164(raw: string): string | null {
 
 export function guestEmailValue(raw: string): string | null {
   const value = raw.trim().toLowerCase()
-  if (value.length === 0 || value.length > GUEST_EMAIL_MAX) return null
+  if (value.length === 0 || value.length > EMAIL_MAX_LENGTH) return null
   return EMAIL_SHAPE.test(value) ? value : null
 }
 
diff --git a/packages/ui/src/bodies/index.ts b/packages/ui/src/bodies/index.ts
index c574a102..c4f0779f 100644
--- a/packages/ui/src/bodies/index.ts
+++ b/packages/ui/src/bodies/index.ts
@@ -18,7 +18,6 @@ export { SettingsAccountBody } from "./SettingsAccountBody"
 export { DonationLinkEditor } from "./settings/DonationLinkEditor"
 export type { DonationLinkEditorProps } from "./settings/DonationLinkEditor"
 export {
-  DONATION_LINK_MAX_LENGTH,
   donationLinkDirty,
   donationLinkFieldError,
   normalizeDonationLink,
diff --git a/packages/ui/src/bodies/postComposer/ComposerMessageField.tsx b/packages/ui/src/bodies/postComposer/ComposerMessageField.tsx
index 6d39b58d..3b0a53d3 100644
--- a/packages/ui/src/bodies/postComposer/ComposerMessageField.tsx
+++ b/packages/ui/src/bodies/postComposer/ComposerMessageField.tsx
@@ -1,13 +1,13 @@
 import React, { useState } from "react"
 import { Pressable, useWindowDimensions, View } from "react-native"
 import type { TFunction } from "i18next"
+import { POST_BODY_MAX } from "@civfix/shared"
 import { TextInput } from "../../primitives/TextInput"
 import { focusRingProps, useLayoutMode, useTheme, webInputReset } from "../../theme"
 import { MentionAutocomplete } from "../../primitives"
 import type { MentionCandidate } from "../../primitives"
 import { ComposerThumbs } from "../../primitives/ComposerThumbs"
 import { Icon, iconMap } from "../../typography"
-import { POST_BODY_MAX_LENGTH } from "../postComposerModel"
 import { usePostComposerStyles } from "./postComposerStyles"
 
 /** The body grows with its text up to this share of the window, then scrolls inside itself. */
@@ -62,7 +62,7 @@ export function ComposerMessageField({
             placeholder={placeholder}
             placeholderTextColor={th.colors.textSubtle}
             multiline
-            maxLength={POST_BODY_MAX_LENGTH}
+            maxLength={POST_BODY_MAX}
             autoFocus
             style={[expanded ? webInputReset : null, styles.input, { maxHeight: inputMaxHeight }]}
           />
diff --git a/packages/ui/src/bodies/postComposerModel.ts b/packages/ui/src/bodies/postComposerModel.ts
index 3e76a4a2..5615fcb8 100644
--- a/packages/ui/src/bodies/postComposerModel.ts
+++ b/packages/ui/src/bodies/postComposerModel.ts
@@ -14,9 +14,6 @@ import type { PostComposerMode } from "./postComposerStore"
 
 export type PostComposerAttachmentPanel = "events" | "reports" | null
 
-/** Mirrors `PostComposeInputSchema.body`'s cap, which the contract states as a bare literal. */
-export const POST_BODY_MAX_LENGTH = 2000
-
 export interface PostComposerModel {
   title: string
   submitLabel: string
diff --git a/packages/ui/src/bodies/profile/certificate/CertificateIssuedPanel.tsx b/packages/ui/src/bodies/profile/certificate/CertificateIssuedPanel.tsx
index 6ed0def5..5fa5c2cd 100644
--- a/packages/ui/src/bodies/profile/certificate/CertificateIssuedPanel.tsx
+++ b/packages/ui/src/bodies/profile/certificate/CertificateIssuedPanel.tsx
@@ -1,6 +1,6 @@
 import React from "react"
 import { View, Pressable } from "react-native"
-import type { ServiceHoursCertificateDTO } from "@civfix/shared"
+import { MS_PER_MINUTE, type ServiceHoursCertificateDTO } from "@civfix/shared"
 import { useTheme, webSelectableText, focusRingProps } from "../../../theme"
 import { Text, Icon, iconMap } from "../../../typography"
 import { MetaDot } from "../../../primitives"
@@ -8,13 +8,12 @@ import { useT } from "../../../i18n"
 import { certificateExpiryLabel } from "../../serviceCertificate"
 import { CertificateCode, CertificateCopyButton } from "./CertificateCode"
 import { useCertificateCardStyles } from "./certificateCardStyles"
-import { MINUTE_MS } from "../../timeUnits"
 
 /** Whole minutes of link life left, floored at 0 (the card has already flipped to `expired` by then). */
 function minutesLeft(expiresAt: string, now: number): number {
   const at = new Date(expiresAt).getTime()
   if (Number.isNaN(at)) return 0
-  return Math.max(0, Math.ceil((at - now) / MINUTE_MS))
+  return Math.max(0, Math.ceil((at - now) / MS_PER_MINUTE))
 }
 
 export function CertificateIssuedPanel({
diff --git a/packages/ui/src/bodies/relativeTime.ts b/packages/ui/src/bodies/relativeTime.ts
index 166cc793..00fedb0b 100644
--- a/packages/ui/src/bodies/relativeTime.ts
+++ b/packages/ui/src/bodies/relativeTime.ts
@@ -1,5 +1,4 @@
-import { relativeAgo, EDIT_WINDOW_HOURS, type RelativeUnitLabels } from "@civfix/shared"
-import { HOUR_MS } from "./timeUnits"
+import { relativeAgo, EDIT_WINDOW_HOURS, MS_PER_HOUR, type RelativeUnitLabels } from "@civfix/shared"
 
 export interface ListTimeAgoOptions {
   justNow?: string
@@ -87,5 +86,5 @@ export function dayLabel(iso: string, opts: DayLabelOptions = {}): string {
 export function withinEditWindow(createdAt: string, now: Date = new Date()): boolean {
   const t = new Date(createdAt).getTime()
   if (Number.isNaN(t)) return false
-  return now.getTime() - t < EDIT_WINDOW_HOURS * HOUR_MS
+  return now.getTime() - t < EDIT_WINDOW_HOURS * MS_PER_HOUR
 }
diff --git a/packages/ui/src/bodies/reportFlow/CaptureStep.tsx b/packages/ui/src/bodies/reportFlow/CaptureStep.tsx
index 866e36bd..72a212ea 100644
--- a/packages/ui/src/bodies/reportFlow/CaptureStep.tsx
+++ b/packages/ui/src/bodies/reportFlow/CaptureStep.tsx
@@ -1,5 +1,6 @@
 import React, { useCallback, useRef, useState } from "react"
 import { View, Pressable, ScrollView, ActivityIndicator } from "react-native"
+import { MAX_REPORT_MEDIA } from "@civfix/shared"
 import {
   makeThemedStyles,
   useTheme,
@@ -13,7 +14,7 @@ import { Text, Icon, iconMap } from "../../typography"
 import { MediaPreview } from "../../primitives"
 import { useCamera } from "../../capabilities"
 import type { CapturedMedia } from "../../capabilities"
-import { useDraftReportStore, MAX_DRAFT_MEDIA, captureSeedsNewReport } from "../../report/draftStore"
+import { useDraftReportStore, captureSeedsNewReport } from "../../report/draftStore"
 import type { DraftMedia } from "../../report/draftStore"
 import {
   useCaptureDropTarget,
@@ -101,7 +102,7 @@ function CapturedMediaStrip({
   const th = useTheme()
   const { t } = useT("report-wizard")
   const removeMedia = useDraftReportStore((s) => s.removeMedia)
-  const atCap = media.length >= MAX_DRAFT_MEDIA
+  const atCap = media.length >= MAX_REPORT_MEDIA
   return (
     <View style={flowStyles.stepBlock}>
       <Text style={flowStyles.fieldLabel}>{t("capture.label_filled")}</Text>
@@ -162,8 +163,8 @@ function CapturedMediaStrip({
       </View>
       <Text style={styles.captureHint}>
         {atCap
-          ? t("capture.hint_at_cap", { max: MAX_DRAFT_MEDIA })
-          : t("capture.hint_add_more", { count: MAX_DRAFT_MEDIA })}
+          ? t("capture.hint_at_cap", { max: MAX_REPORT_MEDIA })
+          : t("capture.hint_add_more", { count: MAX_REPORT_MEDIA })}
       </Text>
       {hint ? <Text style={styles.hintText}>{hint}</Text> : null}
     </View>
diff --git a/packages/ui/src/bodies/reportFlow/DetailsStep.tsx b/packages/ui/src/bodies/reportFlow/DetailsStep.tsx
index 3838f56a..6d8f7b2b 100644
--- a/packages/ui/src/bodies/reportFlow/DetailsStep.tsx
+++ b/packages/ui/src/bodies/reportFlow/DetailsStep.tsx
@@ -1,5 +1,6 @@
 import React from "react"
 import { View } from "react-native"
+import { MAX_REPORT_TITLE_LENGTH } from "@civfix/shared"
 import { makeThemedStyles } from "../../theme"
 import { TextField, Toggle } from "../../primitives"
 import { useDraftReportStore } from "../../report/draftStore"
@@ -7,9 +8,6 @@ import { descriptionMaxLength } from "../../report/submit"
 import { useT } from "../../i18n"
 import { useFlowStyles } from "./flowStyles"
 
-// Mirrors CreateReportRequestSchema's `title` max(120).
-const REPORT_TITLE_MAX_LENGTH = 120
-
 export function DetailsStep() {
   const styles = useStyles()
   const flowStyles = useFlowStyles()
@@ -25,7 +23,7 @@ export function DetailsStep() {
         placeholder={t("details.title_placeholder")}
         value={draft.title}
         onChangeText={setTitle}
-        maxLength={REPORT_TITLE_MAX_LENGTH}
+        maxLength={MAX_REPORT_TITLE_LENGTH}
       />
       <TextField
         label={t("details.description_label")}
diff --git a/packages/ui/src/bodies/reportPicker/reportPickerModel.ts b/packages/ui/src/bodies/reportPicker/reportPickerModel.ts
index ca6b5c39..f53a3ab8 100644
--- a/packages/ui/src/bodies/reportPicker/reportPickerModel.ts
+++ b/packages/ui/src/bodies/reportPicker/reportPickerModel.ts
@@ -1,5 +1,6 @@
 import {
   haversineMeters,
+  isUuid,
   type BBox,
   type LinkedReportRef,
   type ReportCategory,
@@ -177,13 +178,12 @@ export function mergePins(...groups: ReadonlyArray<readonly ReportPinDTO[]>): Re
   return [...byId.values()]
 }
 
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 const REFERENCE_CODE_PATTERN = /^[a-z]{2,4}-\d{1,6}-\d{6}$/i
 const SHORT_ID_LENGTH = 8
 
 export function reportLookupKey(query: string): string | null {
   const q = query.trim()
-  if (UUID_PATTERN.test(q)) return q.toLowerCase()
+  if (isUuid(q)) return q.toLowerCase()
   if (REFERENCE_CODE_PATTERN.test(q)) return q.toUpperCase()
   return null
 }
diff --git a/packages/ui/src/bodies/settings/ChangeUsernameEditor.tsx b/packages/ui/src/bodies/settings/ChangeUsernameEditor.tsx
index df3bef28..1d5cc866 100644
--- a/packages/ui/src/bodies/settings/ChangeUsernameEditor.tsx
+++ b/packages/ui/src/bodies/settings/ChangeUsernameEditor.tsx
@@ -1,5 +1,5 @@
 import React from "react"
-import { ErrorCode, errorCopyKey, isValidHandle, type ErrorCodeTable } from "@civfix/shared"
+import { HANDLE_MAX_LENGTH, ErrorCode, errorCopyKey, isValidHandle, type ErrorCodeTable } from "@civfix/shared"
 import { Text } from "../../typography"
 import { SettingsRow, TextField } from "../../primitives"
 import { useHandleAvailability } from "../../data"
@@ -11,8 +11,6 @@ import { useSheetEditor } from "./useSheetEditor"
 
 type Translate = (key: string, options?: Record<string, unknown>) => string
 
-const HANDLE_MAX_LENGTH = 20
-
 const HANDLE_ERROR_KEYS: ErrorCodeTable<string> = {
   [ErrorCode.RATE_LIMITED]: "handle.error.rate_limited",
   [ErrorCode.CONFLICT]: "handle.error.taken",
diff --git a/packages/ui/src/bodies/settings/DisplayNameEditor.tsx b/packages/ui/src/bodies/settings/DisplayNameEditor.tsx
index 42ba84bb..2c98db07 100644
--- a/packages/ui/src/bodies/settings/DisplayNameEditor.tsx
+++ b/packages/ui/src/bodies/settings/DisplayNameEditor.tsx
@@ -1,4 +1,5 @@
 import React from "react"
+import { DISPLAY_NAME_MAX_LENGTH } from "@civfix/shared"
 import { Text } from "../../typography"
 import { TextField } from "../../primitives"
 import { useT } from "../../i18n"
@@ -7,8 +8,6 @@ import { useEditorStyles } from "./editorStyles"
 import { SettingsEditorSheet } from "./SettingsEditorSheet"
 import { useSheetEditor } from "./useSheetEditor"
 
-const MAX_DISPLAY_NAME_LENGTH = 80
-
 export interface DisplayNameEditorProps {
   currentName: string
   saving?: boolean
@@ -26,7 +25,7 @@ export function DisplayNameEditor({ currentName, saving, onSave }: DisplayNameEd
   const { draft, setDraft, submitError } = editor
 
   const trimmed = draft.trim()
-  const valid = trimmed.length > 0 && trimmed.length <= MAX_DISPLAY_NAME_LENGTH
+  const valid = trimmed.length > 0 && trimmed.length <= DISPLAY_NAME_MAX_LENGTH
   const unchanged = trimmed === currentName.trim()
   const canSave = !saving && valid && !unchanged
 
@@ -60,7 +59,7 @@ export function DisplayNameEditor({ currentName, saving, onSave }: DisplayNameEd
         placeholder={t("name.placeholder")}
         value={draft}
         onChangeText={setDraft}
-        maxLength={MAX_DISPLAY_NAME_LENGTH}
+        maxLength={DISPLAY_NAME_MAX_LENGTH}
         editable={!saving}
         returnKeyType="done"
         onSubmitEditing={save}
diff --git a/packages/ui/src/bodies/settings/DonationLinkEditor.tsx b/packages/ui/src/bodies/settings/DonationLinkEditor.tsx
index 9a24bb84..783aa821 100644
--- a/packages/ui/src/bodies/settings/DonationLinkEditor.tsx
+++ b/packages/ui/src/bodies/settings/DonationLinkEditor.tsx
@@ -1,4 +1,5 @@
 import React from "react"
+import { HTTPS_URL_MAX_LENGTH } from "@civfix/shared"
 import { Text, TextLink } from "../../typography"
 import { TextField } from "../../primitives"
 import { donationUrlHost, safeDonationUrl } from "../../primitives/donationUrl"
@@ -8,7 +9,6 @@ import { useEditorStyles } from "./editorStyles"
 import { SettingsEditorSheet } from "./SettingsEditorSheet"
 import { useSheetEditor } from "./useSheetEditor"
 import {
-  DONATION_LINK_MAX_LENGTH,
   donationLinkDirty,
   donationLinkFieldError,
   normalizeDonationLink,
@@ -67,7 +67,7 @@ export function DonationLinkEditor({ currentUrl, saving, onSave }: DonationLinkE
         autoCapitalize="none"
         autoCorrect={false}
         keyboardType="url"
-        maxLength={DONATION_LINK_MAX_LENGTH}
+        maxLength={HTTPS_URL_MAX_LENGTH}
         editable={!saving}
         accessibilityLabel={t("editor.field_label")}
       />
diff --git a/packages/ui/src/bodies/settings/__tests__/donationLinkField.test.ts b/packages/ui/src/bodies/settings/__tests__/donationLinkField.test.ts
index 4e2f6fe1..fbf2ad91 100644
--- a/packages/ui/src/bodies/settings/__tests__/donationLinkField.test.ts
+++ b/packages/ui/src/bodies/settings/__tests__/donationLinkField.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from "vitest"
-import { HttpsUrlSchema } from "@civfix/shared"
+import { HTTPS_URL_MAX_LENGTH, HttpsUrlSchema } from "@civfix/shared"
 import {
-  DONATION_LINK_MAX_LENGTH,
   donationLinkDirty,
   donationLinkFieldError,
   normalizeDonationLink,
@@ -40,7 +39,7 @@ describe("the donation-link field rule", () => {
 
   it("caps the field at the contract's own maximum", () => {
     const base = "https://give.example.org/"
-    const atMax = base + "a".repeat(DONATION_LINK_MAX_LENGTH - base.length)
+    const atMax = base + "a".repeat(HTTPS_URL_MAX_LENGTH - base.length)
     expect(HttpsUrlSchema.safeParse(atMax).success).toBe(true)
     expect(HttpsUrlSchema.safeParse(`${atMax}a`).success).toBe(false)
   })
diff --git a/packages/ui/src/bodies/settings/donationLinkField.ts b/packages/ui/src/bodies/settings/donationLinkField.ts
index 28dd29e1..e0792c7f 100644
--- a/packages/ui/src/bodies/settings/donationLinkField.ts
+++ b/packages/ui/src/bodies/settings/donationLinkField.ts
@@ -1,8 +1,6 @@
 import { HttpsUrlSchema } from "@civfix/shared"
 import { safeDonationUrl } from "../../primitives/donationUrl"
 
-export const DONATION_LINK_MAX_LENGTH = 500
-
 export type DonationLinkFieldError = "invalid" | null
 
 export function normalizeDonationLink(raw: string): string | null {
diff --git a/packages/ui/src/bodies/thread/ReplyComposer.tsx b/packages/ui/src/bodies/thread/ReplyComposer.tsx
index e9671b12..ba70e497 100644
--- a/packages/ui/src/bodies/thread/ReplyComposer.tsx
+++ b/packages/ui/src/bodies/thread/ReplyComposer.tsx
@@ -32,6 +32,7 @@ import {
 import { TextInput } from "../../primitives/TextInput"
 import { useQueryClient } from "@tanstack/react-query"
 import type { CleanupDTO, LinkedEventRef, PostDTO, ReportDTO } from "@civfix/shared"
+import { POST_BODY_MAX } from "@civfix/shared"
 import { focusRingProps, makeThemedStyles, wash, useLayoutMode, useTheme, webInputReset, inputFocusedStyle, MIN_TOUCH_TARGET } from "../../theme"
 import { useReducedMotion } from "../../theme/useReducedMotion"
 import { Text, Icon, iconMap } from "../../typography"
@@ -75,8 +76,6 @@ import { buildOptimisticReply } from "./optimisticReply"
 const SURFACE_PADDING = 16
 /** The two 6pt gaps between the three measured/flexing blocks - the rest of `measuredChrome`. */
 const SURFACE_GAPS = 12
-/** The shared `PostComposeInputSchema` cap; the counter appears in the last 200 and reddens in the last 50. */
-const BODY_MAX = 2000
 const COUNTER_VISIBLE_AT = 200
 const COUNTER_URGENT_AT = 50
 const REPLY_FOCUS_AFTER_SEND = composerFocusAfterSend("thread-reply")
@@ -340,7 +339,7 @@ export function ReplyComposer({ focalPost, rootHeight, onPosted, ref }: ReplyCom
     )
   }
 
-  const remaining = BODY_MAX - draft.body.length
+  const remaining = POST_BODY_MAX - draft.body.length
   const targetHandle = focalPost.author.handle ? normalizeHandle(focalPost.author.handle) : null
   const replyingTo = targetHandle
     ? t("reply.context", { handle: `@${targetHandle}` })
@@ -404,7 +403,7 @@ export function ReplyComposer({ focalPost, rootHeight, onPosted, ref }: ReplyCom
             placeholder={t("reply.placeholder_named")}
             placeholderTextColor={th.colors.textSubtle}
             multiline
-            maxLength={BODY_MAX}
+            maxLength={POST_BODY_MAX}
             onContentSizeChange={grow.onContentSizeChange}
             onKeyPress={onKeyPress}
             style={[
diff --git a/packages/ui/src/bodies/timeUnits.ts b/packages/ui/src/bodies/timeUnits.ts
deleted file mode 100644
index b76219a9..00000000
--- a/packages/ui/src/bodies/timeUnits.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-export const MINUTE_MS = 60_000
-export const HOUR_MS = 60 * MINUTE_MS
-export const DAY_MS = 24 * HOUR_MS
diff --git a/packages/ui/src/data/__tests__/firstRunModel.test.ts b/packages/ui/src/data/__tests__/firstRunModel.test.ts
index 12913e4b..45582622 100644
--- a/packages/ui/src/data/__tests__/firstRunModel.test.ts
+++ b/packages/ui/src/data/__tests__/firstRunModel.test.ts
@@ -1,8 +1,7 @@
 import { readFileSync } from "node:fs"
 import { describe, expect, it } from "vitest"
-import { UpdateProfileRequestSchema } from "@civfix/shared"
+import { DISPLAY_NAME_MAX_LENGTH, UpdateProfileRequestSchema } from "@civfix/shared"
 import {
-  DISPLAY_NAME_MAX,
   FIRST_NAME_MAX,
   LAST_NAME_MAX,
   firstRunModel,
@@ -26,17 +25,17 @@ const model = (over: Partial<FirstRunInput> = {}) => firstRunModel({ ...READY, .
 
 describe("first-run name caps", () => {
   it("uses the display-name cap the profile save validates against", () => {
-    expect(DISPLAY_NAME_MAX).toBe(UpdateProfileRequestSchema.shape.displayName.maxLength)
+    expect(DISPLAY_NAME_MAX_LENGTH).toBe(UpdateProfileRequestSchema.shape.displayName.maxLength)
   })
 
   it("fits the first and last name caps plus the joining space inside the display name cap", () => {
-    expect(FIRST_NAME_MAX).toBeLessThan(DISPLAY_NAME_MAX - 1)
-    expect(FIRST_NAME_MAX + 1 + LAST_NAME_MAX).toBe(DISPLAY_NAME_MAX)
+    expect(FIRST_NAME_MAX).toBeLessThan(DISPLAY_NAME_MAX_LENGTH - 1)
+    expect(FIRST_NAME_MAX + 1 + LAST_NAME_MAX).toBe(DISPLAY_NAME_MAX_LENGTH)
   })
 
   it("never lets a seeded name longer than the cap be submitted", () => {
     const view = model({ first: "a".repeat(50), last: "b".repeat(35) })
-    expect(view.displayName.length).toBeGreaterThan(DISPLAY_NAME_MAX)
+    expect(view.displayName.length).toBeGreaterThan(DISPLAY_NAME_MAX_LENGTH)
     expect(view.canSubmit).toBe(false)
     expect(model({ first: "a".repeat(40), last: "b".repeat(39) }).canSubmit).toBe(true)
   })
diff --git a/packages/ui/src/data/firstRunModel.ts b/packages/ui/src/data/firstRunModel.ts
index 92fad1b3..f99a0019 100644
--- a/packages/ui/src/data/firstRunModel.ts
+++ b/packages/ui/src/data/firstRunModel.ts
@@ -1,10 +1,9 @@
-import { isValidHandle, type HandleAvailableResponse } from "@civfix/shared"
+import { DISPLAY_NAME_MAX_LENGTH, isValidHandle, type HandleAvailableResponse } from "@civfix/shared"
 
-// Mirrors UpdateProfileRequestSchema's displayName max. The two fields plus the joining space must fit,
-// or the server rejects the save with a VALIDATION error the user cannot act on.
-export const DISPLAY_NAME_MAX = 80
+// The two fields plus the joining space must fit the display name cap, or the server rejects the save
+// with a VALIDATION error the user cannot act on.
 export const FIRST_NAME_MAX = 40
-export const LAST_NAME_MAX = DISPLAY_NAME_MAX - FIRST_NAME_MAX - 1
+export const LAST_NAME_MAX = DISPLAY_NAME_MAX_LENGTH - FIRST_NAME_MAX - 1
 
 export function splitName(displayName: string): { first: string; last: string } {
   const parts = displayName.trim().split(/\s+/).filter(Boolean)
@@ -70,7 +69,7 @@ export function firstRunModel(input: FirstRunInput): FirstRunView {
     canSubmit:
       available &&
       displayName.length > 0 &&
-      displayName.length <= DISPLAY_NAME_MAX &&
+      displayName.length <= DISPLAY_NAME_MAX_LENGTH &&
       input.ageConfirmed &&
       input.termsConfirmed &&
       !input.submitting,
diff --git a/packages/ui/src/data/hooks/__tests__/volunteer.test.ts b/packages/ui/src/data/hooks/__tests__/volunteer.test.ts
index c0bd76ea..7422a52e 100644
--- a/packages/ui/src/data/hooks/__tests__/volunteer.test.ts
+++ b/packages/ui/src/data/hooks/__tests__/volunteer.test.ts
@@ -10,7 +10,7 @@
 import { readFileSync } from "node:fs"
 import { describe, expect, it } from "vitest"
 import { sliceBetween, sliceFrom } from "../../../__tests__/sourceGuards"
-import { LeaderboardQuerySchema } from "@civfix/shared"
+import { LeaderboardQuerySchema, MAX_LEADERBOARD_OFFSET } from "@civfix/shared"
 import { leaderboardNextOffset } from "../volunteer"
 
 /**
@@ -71,10 +71,9 @@ describe("hooks/volunteer.ts", () => {
   })
 
   it("pins that clamp to the request schema's own bound, so the two cannot drift", () => {
-    // The bound is duplicated in the hook because the schema does not export it. These two assertions
-    // are the tripwire: move `.max(500)` in either direction and this reds instead of the field.
-    const bound = Number(/const LEADERBOARD_MAX_OFFSET = (\d+)/.exec(volunteerSource)?.[1])
-    expect(Number.isInteger(bound)).toBe(true)
+    const bound = MAX_LEADERBOARD_OFFSET
+    expect(leaderboardNextOffset({ geoid: "0644000", entries: [], nextOffset: bound })).toBe(bound)
+    expect(leaderboardNextOffset({ geoid: "0644000", entries: [], nextOffset: bound + 1 })).toBeUndefined()
     expect(LeaderboardQuerySchema.safeParse({ geoid: "0644000", offset: bound }).success).toBe(true)
     expect(LeaderboardQuerySchema.safeParse({ geoid: "0644000", offset: bound + 1 }).success).toBe(
       false,
diff --git a/packages/ui/src/data/hooks/volunteer.ts b/packages/ui/src/data/hooks/volunteer.ts
index 3385bdae..d8ac1299 100644
--- a/packages/ui/src/data/hooks/volunteer.ts
+++ b/packages/ui/src/data/hooks/volunteer.ts
@@ -25,6 +25,7 @@
  * list.
  */
 import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
+import { MAX_LEADERBOARD_OFFSET } from "@civfix/shared"
 import type {
   EventHoursEntry,
   EventHoursResponse,
@@ -56,26 +57,21 @@ const LEADERBOARD_STALE_MS = 5 * 60_000
 const LEADERBOARD_GC_MS = 30 * 60_000
 
 /**
- * The deepest `offset` the endpoint ACCEPTS: `LeaderboardQuerySchema.offset` is `.max(500)`, and the
- * route parses that schema strictly, so an offset past it is a 422 rather than an empty page.
+ * MAX_LEADERBOARD_OFFSET is the deepest `offset` the endpoint ACCEPTS: the route parses
+ * `LeaderboardQuerySchema` strictly, so an offset past it is a 422 rather than an empty page.
  *
  * The response's `nextOffset` is computed with no such ceiling, so at a 50-row page size page 11 comes
  * back advertising `nextOffset: 550`; handing that straight back to the query would turn "end of a very
  * long board" into a failed request. The clamp below makes the last accepted page the last page, which
  * is what `hasNextPage` (and therefore LeaderboardBody's `onEndReached`) then reports.
- *
- * The number is duplicated rather than imported because the schema does not export its bound; the unit
- * test asserts it against `LeaderboardQuerySchema` itself so the two cannot drift.
  */
-const LEADERBOARD_MAX_OFFSET = 500
-
 /**
  * The infinite query's `getNextPageParam`, lifted out so it is unit-testable without a query client.
  * `undefined` = end of list. Exported for that test only; it is NOT re-exported from `src/data`.
  */
 export function leaderboardNextOffset(lastPage: LeaderboardResponse): number | undefined {
   const next = lastPage.nextOffset
-  return typeof next === "number" && next <= LEADERBOARD_MAX_OFFSET ? next : undefined
+  return typeof next === "number" && next <= MAX_LEADERBOARD_OFFSET ? next : undefined
 }
 
 /**
diff --git a/packages/ui/src/data/inbound.ts b/packages/ui/src/data/inbound.ts
index 43484878..1970765b 100644
--- a/packages/ui/src/data/inbound.ts
+++ b/packages/ui/src/data/inbound.ts
@@ -1,5 +1,6 @@
 import {
   ErrorCode,
+  WsErrorCode,
   effectiveClientId,
   preserveViewerFields,
   reconcileInbound,
@@ -239,13 +240,13 @@ export function isFatalRoomErrorCode(code: string): boolean {
 }
 
 const SEND_REJECTION_ERROR_CODES: ReadonlySet<string> = new Set([
-  "BAD_FRAME",
-  "BLOCKED",
+  WsErrorCode.BAD_FRAME,
+  WsErrorCode.BLOCKED,
   ErrorCode.RATE_LIMITED,
   ErrorCode.VALIDATION,
-  "channel_read_only",
-  "reply_wrong_room",
-  "reply_deleted_target",
+  WsErrorCode.CHANNEL_READ_ONLY,
+  WsErrorCode.REPLY_WRONG_ROOM,
+  WsErrorCode.REPLY_DELETED_TARGET,
 ])
 
 export function isSendRejectionErrorCode(code: string): boolean {
diff --git a/packages/ui/src/data/index.ts b/packages/ui/src/data/index.ts
index 113daede..c35ff371 100644
--- a/packages/ui/src/data/index.ts
+++ b/packages/ui/src/data/index.ts
@@ -145,5 +145,5 @@ export { fetchApproximateLocation } from "./fetchApproximateLocation"
 export { NOW_TICK_MS, useNow } from "./useNow"
 export { SEARCH_DEBOUNCE_MS, useDebouncedValue } from "./hooks/useDebouncedValue"
 export { useEventBoundaryRefresh } from "./useEventBoundaryRefresh"
-export { DISPLAY_NAME_MAX, FIRST_NAME_MAX, LAST_NAME_MAX, firstRunModel, splitName, stripHandlePrefix } from "./firstRunModel"
+export { FIRST_NAME_MAX, LAST_NAME_MAX, firstRunModel, splitName, stripHandlePrefix } from "./firstRunModel"
 export type { FirstRunAvailability, FirstRunInput, FirstRunView } from "./firstRunModel"
diff --git a/packages/ui/src/i18n/__tests__/resourcesParity.test.ts b/packages/ui/src/i18n/__tests__/resourcesParity.test.ts
index 06834e0a..b3ab67cb 100644
--- a/packages/ui/src/i18n/__tests__/resourcesParity.test.ts
+++ b/packages/ui/src/i18n/__tests__/resourcesParity.test.ts
@@ -1,5 +1,5 @@
 import { readdirSync } from "node:fs"
-import { LocaleEnum } from "@civfix/shared"
+import { SupportedLocaleSchema } from "@civfix/shared"
 import { describe, expect, it } from "vitest"
 import { initialResources, loadCatalog } from "../bundledCatalogs"
 import * as nativeSeam from "../bundledCatalogs.native"
@@ -19,7 +19,7 @@ describe("every locale file is registered in resources.ts", () => {
     expect([...namespaces].sort()).toEqual(namespaceFiles("en"))
   })
 
-  it.each(LocaleEnum.options)("bundles every %s namespace under resources", (lng) => {
+  it.each(SupportedLocaleSchema.options)("bundles every %s namespace under resources", (lng) => {
     const bundled = Object.keys(resources[lng] ?? {}).sort()
     expect(bundled).toEqual(namespaceFiles(lng))
   })
@@ -33,11 +33,11 @@ describe("the web seam bundles English and lazy-loads every other locale", () =>
 
   it("has a chunk loader for every other locale, and nothing else", () => {
     expect(Object.keys(lazyCatalogs).sort()).toEqual(
-      LocaleEnum.options.filter((lng) => lng !== FALLBACK_LOCALE).sort(),
+      SupportedLocaleSchema.options.filter((lng) => lng !== FALLBACK_LOCALE).sort(),
     )
   })
 
-  it.each(LocaleEnum.options)("loads the same %s catalog the static resources carry", async (lng) => {
+  it.each(SupportedLocaleSchema.options)("loads the same %s catalog the static resources carry", async (lng) => {
     expect(await loadCatalog(lng)).toBe(resources[lng])
   })
 })
@@ -45,6 +45,6 @@ describe("the web seam bundles English and lazy-loads every other locale", () =>
 describe("the native seam bundles every locale", () => {
   it("starts with all of them, so mobile never waits on a catalog", () => {
     expect(nativeSeam.initialResources).toBe(resources)
-    expect(Object.keys(nativeSeam.initialResources).sort()).toEqual([...LocaleEnum.options].sort())
+    expect(Object.keys(nativeSeam.initialResources).sort()).toEqual([...SupportedLocaleSchema.options].sort())
   })
 })
diff --git a/packages/ui/src/i18n/config.ts b/packages/ui/src/i18n/config.ts
index 2831f75a..a90a9845 100644
--- a/packages/ui/src/i18n/config.ts
+++ b/packages/ui/src/i18n/config.ts
@@ -8,7 +8,7 @@
  */
 import i18next, { type i18n as I18nInstance } from "i18next"
 import { initReactI18next } from "react-i18next"
-import { LocaleEnum, type SupportedLocale } from "@civfix/shared"
+import { SupportedLocaleSchema, type SupportedLocale } from "@civfix/shared"
 import { initialResources } from "./bundledCatalogs"
 import { namespaces } from "./catalogs/namespaces"
 import { FALLBACK_LOCALE } from "./resolveLocale"
@@ -24,7 +24,7 @@ export function createI18n(locale: SupportedLocale = FALLBACK_LOCALE): I18nInsta
   void instance.use(initReactI18next).init({
     lng: locale in initialResources ? locale : FALLBACK_LOCALE,
     fallbackLng: FALLBACK_LOCALE,
-    supportedLngs: LocaleEnum.options,
+    supportedLngs: SupportedLocaleSchema.options,
     ns: namespaces as unknown as string[],
     defaultNS,
     // A copy, because i18next adds loaded catalogs into the object it is given, and that object is a
diff --git a/packages/ui/src/i18n/resolveLocale.ts b/packages/ui/src/i18n/resolveLocale.ts
index 772b62ce..bc682550 100644
--- a/packages/ui/src/i18n/resolveLocale.ts
+++ b/packages/ui/src/i18n/resolveLocale.ts
@@ -1,4 +1,4 @@
-import { LocaleEnum, type SupportedLocale } from "@civfix/shared"
+import { SupportedLocaleSchema, type SupportedLocale } from "@civfix/shared"
 
 export const supportedLocales: ReadonlyArray<{ code: SupportedLocale; nativeName: string }> = [
   { code: "en", nativeName: "English" },
@@ -7,7 +7,7 @@ export const supportedLocales: ReadonlyArray<{ code: SupportedLocale; nativeName
   { code: "ko", nativeName: "한국어" },
 ]
 
-const SUPPORTED = new Set<string>(LocaleEnum.options)
+const SUPPORTED = new Set<string>(SupportedLocaleSchema.options)
 
 export const FALLBACK_LOCALE: SupportedLocale = "en"
 
diff --git a/packages/ui/src/primitives/CancelEventSheet.tsx b/packages/ui/src/primitives/CancelEventSheet.tsx
index 073660bf..23e112b7 100644
--- a/packages/ui/src/primitives/CancelEventSheet.tsx
+++ b/packages/ui/src/primitives/CancelEventSheet.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback, useState } from "react"
+import { MAX_EVENT_CANCEL_REASON } from "@civfix/shared"
 import { TextInput } from "./TextInput"
 import { makeThemedStyles, useTheme, webInputReset, inputFocusedStyle } from "../theme"
 import { Text } from "../typography"
@@ -8,8 +9,6 @@ import { ModalCardSheet, modalSheetInputStyle } from "./ModalCardSheet"
 import { useT } from "../i18n"
 import { useResetOnOpen } from "./useModalClosed"
 
-const REASON_MAX = 500
-
 export interface CancelEventSheetProps {
   visible: boolean
   pending?: boolean
@@ -71,10 +70,10 @@ export function CancelEventSheet({
 
       <TextInput
         value={reason}
-        onChangeText={(next) => setReason(next.slice(0, REASON_MAX))}
+        onChangeText={(next) => setReason(next.slice(0, MAX_EVENT_CANCEL_REASON))}
         editable={!pending}
         multiline
-        maxLength={REASON_MAX}
+        maxLength={MAX_EVENT_CANCEL_REASON}
         placeholder={t("reason.placeholder")}
         placeholderTextColor={th.colors.textSubtle}
         accessibilityLabel={t("reason.a11y")}
diff --git a/packages/ui/src/primitives/PollCreateSheet.tsx b/packages/ui/src/primitives/PollCreateSheet.tsx
index 9cffad55..89d526b7 100644
--- a/packages/ui/src/primitives/PollCreateSheet.tsx
+++ b/packages/ui/src/primitives/PollCreateSheet.tsx
@@ -9,6 +9,7 @@ import { SecondaryButton } from "./SecondaryButton"
 import { Toggle } from "./Toggle"
 import { ModalCardSheet, modalSheetInputStyle } from "./ModalCardSheet"
 import { useResetOnOpen } from "./useModalClosed"
+import { POLL_MIN_OPTIONS, POLL_OPTION_MAX, POLL_QUESTION_MAX } from "@civfix/shared"
 import {
   emptyPollDraft,
   setQuestion,
@@ -16,9 +17,6 @@ import {
   removeOption,
   canCreatePoll,
   toCreateInput,
-  POLL_QUESTION_MAX,
-  POLL_OPTION_MAX,
-  POLL_MIN_OPTIONS,
   type PollDraft,
 } from "./pollDraft"
 
diff --git a/packages/ui/src/primitives/ReportContentSheet.tsx b/packages/ui/src/primitives/ReportContentSheet.tsx
index d20bbbd6..15bb7a88 100644
--- a/packages/ui/src/primitives/ReportContentSheet.tsx
+++ b/packages/ui/src/primitives/ReportContentSheet.tsx
@@ -1,7 +1,7 @@
 import React, { useCallback, useState } from "react"
 import { View, Pressable, StyleSheet } from "react-native"
 import { TextInput } from "./TextInput"
-import type { ContentReportReason } from "@civfix/shared"
+import { CONTENT_REPORT_DETAILS_MAX, type ContentReportReason } from "@civfix/shared"
 import { a11yState, makeThemedStyles, useTheme, webInputReset, focusRingProps, inputFocusedStyle } from "../theme"
 import { Text, Icon, iconMap } from "../typography"
 import { useT } from "../i18n"
@@ -21,7 +21,6 @@ const REASON_VALUES: ReadonlyArray<ContentReportReason> = [
   "other",
 ]
 
-const DETAILS_MAX = 1000
 
 export interface ReportContentSheetProps {
   visible: boolean
@@ -118,10 +117,10 @@ export function ReportContentSheet({
 
       <TextInput
         value={details}
-        onChangeText={(next) => setDetails(next.slice(0, DETAILS_MAX))}
+        onChangeText={(next) => setDetails(next.slice(0, CONTENT_REPORT_DETAILS_MAX))}
         editable={!pending}
         multiline
-        maxLength={DETAILS_MAX}
+        maxLength={CONTENT_REPORT_DETAILS_MAX}
         placeholder={t("details.placeholder")}
         placeholderTextColor={th.colors.textSubtle}
         accessibilityLabel={t("details.a11y")}
diff --git a/packages/ui/src/primitives/RequestResourcesSheet.tsx b/packages/ui/src/primitives/RequestResourcesSheet.tsx
index 3115d34f..e4a634e3 100644
--- a/packages/ui/src/primitives/RequestResourcesSheet.tsx
+++ b/packages/ui/src/primitives/RequestResourcesSheet.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback, useState } from "react"
+import { MAX_EVENT_RESOURCES_MESSAGE } from "@civfix/shared"
 import { TextInput } from "./TextInput"
 import { makeThemedStyles, useTheme, webInputReset, inputFocusedStyle } from "../theme"
 import { Text } from "../typography"
@@ -8,8 +9,6 @@ import { SecondaryButton } from "./SecondaryButton"
 import { ModalCardSheet, modalSheetInputStyle } from "./ModalCardSheet"
 import { useResetOnOpen } from "./useModalClosed"
 
-const MESSAGE_MAX = 2000
-
 export interface RequestResourcesSheetProps {
   visible: boolean
   pending?: boolean
@@ -68,10 +67,10 @@ export function RequestResourcesSheet({
 
       <TextInput
         value={message}
-        onChangeText={(next) => setMessage(next.slice(0, MESSAGE_MAX))}
+        onChangeText={(next) => setMessage(next.slice(0, MAX_EVENT_RESOURCES_MESSAGE))}
         editable={!pending}
         multiline
-        maxLength={MESSAGE_MAX}
+        maxLength={MAX_EVENT_RESOURCES_MESSAGE}
         placeholder={t("message_placeholder")}
         placeholderTextColor={th.colors.textSubtle}
         accessibilityLabel={t("message_a11y")}
diff --git a/packages/ui/src/primitives/__tests__/pollDraft.test.ts b/packages/ui/src/primitives/__tests__/pollDraft.test.ts
index 3c6d31f3..8452d1e4 100644
--- a/packages/ui/src/primitives/__tests__/pollDraft.test.ts
+++ b/packages/ui/src/primitives/__tests__/pollDraft.test.ts
@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest"
+import { POLL_MAX_OPTIONS, POLL_MIN_OPTIONS, POLL_OPTION_MAX, POLL_QUESTION_MAX } from "@civfix/shared"
 import {
   emptyPollDraft,
   setQuestion,
@@ -7,10 +8,6 @@ import {
   normalizeOptions,
   canCreatePoll,
   toCreateInput,
-  POLL_QUESTION_MAX,
-  POLL_OPTION_MAX,
-  POLL_MIN_OPTIONS,
-  POLL_MAX_OPTIONS,
   type PollDraft,
 } from "../pollDraft"
 
diff --git a/packages/ui/src/primitives/externalUrls.ts b/packages/ui/src/primitives/externalUrls.ts
index f21e6a34..6d0053b8 100644
--- a/packages/ui/src/primitives/externalUrls.ts
+++ b/packages/ui/src/primitives/externalUrls.ts
@@ -1,3 +1,4 @@
+import { stripTrailingSlashes } from "@civfix/shared"
 import { SOURCE_REPO_URL, sourceLink } from "@civfix/shared/legal"
 
 export const WEB_ORIGIN = "https://civfix.org"
@@ -5,7 +6,7 @@ export const WEB_ORIGIN = "https://civfix.org"
 let configuredWebOrigin = WEB_ORIGIN
 
 export function setWebOrigin(origin: string): void {
-  configuredWebOrigin = origin.replace(/\/+$/, "")
+  configuredWebOrigin = stripTrailingSlashes(origin)
 }
 
 export function webOrigin(): string {
diff --git a/packages/ui/src/primitives/pollDraft.ts b/packages/ui/src/primitives/pollDraft.ts
index 912d65a6..ae8989b2 100644
--- a/packages/ui/src/primitives/pollDraft.ts
+++ b/packages/ui/src/primitives/pollDraft.ts
@@ -1,9 +1,4 @@
-/** Pure draft model behind PollCreateSheet. The bounds mirror CreatePollRequest's server limits. */
-
-export const POLL_QUESTION_MAX = 300
-export const POLL_OPTION_MAX = 100
-export const POLL_MIN_OPTIONS = 2
-export const POLL_MAX_OPTIONS = 10
+import { POLL_MAX_OPTIONS, POLL_MIN_OPTIONS, POLL_OPTION_MAX, POLL_QUESTION_MAX } from "@civfix/shared"
 
 /**
  * Rows carry an id because keying or focusing by position would hand a removed row's focus and native
diff --git a/packages/ui/src/report/__tests__/draftStore.test.ts b/packages/ui/src/report/__tests__/draftStore.test.ts
index 9654daa2..658aabe1 100644
--- a/packages/ui/src/report/__tests__/draftStore.test.ts
+++ b/packages/ui/src/report/__tests__/draftStore.test.ts
@@ -1,5 +1,6 @@
 import { describe, it, expect, beforeEach, vi } from "vitest"
-import { useDraftReportStore, MAX_DRAFT_MEDIA, captureSeedsNewReport } from "../draftStore"
+import { MAX_REPORT_MEDIA } from "@civfix/shared"
+import { useDraftReportStore, captureSeedsNewReport } from "../draftStore"
 import type { CapturedMedia } from "../../capabilities"
 
 /**
@@ -35,11 +36,11 @@ describe("draftStore media", () => {
     expect(useDraftReportStore.getState().draft.idempotencyKey).toBeTruthy()
   })
 
-  it("caps the media list at MAX_DRAFT_MEDIA", () => {
+  it("caps the media list at MAX_REPORT_MEDIA", () => {
     const s = useDraftReportStore.getState()
     s.startFromCapture(cap("0"))
-    for (let i = 1; i < MAX_DRAFT_MEDIA + 3; i++) s.addCapture(cap(String(i)))
-    expect(useDraftReportStore.getState().draft.media.length).toBe(MAX_DRAFT_MEDIA)
+    for (let i = 1; i < MAX_REPORT_MEDIA + 3; i++) s.addCapture(cap(String(i)))
+    expect(useDraftReportStore.getState().draft.media.length).toBe(MAX_REPORT_MEDIA)
   })
 
   it("removeMedia drops one item by uri, keeping the rest in order", () => {
@@ -392,7 +393,7 @@ describe("releasing captures that leave the draft", () => {
   it("releases a capture the media cap turned away", () => {
     const s = useDraftReportStore.getState()
     s.startFromCapture(cap("0"))
-    for (let i = 1; i < MAX_DRAFT_MEDIA; i++) s.addCapture(cap(String(i)))
+    for (let i = 1; i < MAX_REPORT_MEDIA; i++) s.addCapture(cap(String(i)))
     const extra = releasable("blob:extra")
     s.addCapture(extra.media)
     expect(useDraftReportStore.getState().draft.media.map((m) => m.uri)).not.toContain("blob:extra")
diff --git a/packages/ui/src/report/__tests__/submitRecovery.test.ts b/packages/ui/src/report/__tests__/submitRecovery.test.ts
index 0e83c7c1..b3006e53 100644
--- a/packages/ui/src/report/__tests__/submitRecovery.test.ts
+++ b/packages/ui/src/report/__tests__/submitRecovery.test.ts
@@ -1,8 +1,7 @@
 import { beforeEach, describe, expect, it } from "vitest"
-import { AppError, ErrorCode, CreateReportRequestSchema } from "@civfix/shared"
+import { AppError, ErrorCode, CreateReportRequestSchema, MAX_REPORT_DESCRIPTION_LENGTH } from "@civfix/shared"
 import { STEP_ORDER_COMPACT, STEP_ORDER_EXPANDED, stepOrderFor, submitErrorRecovery } from "../wizardSteps"
 import {
-  REPORT_DESCRIPTION_MAX,
   composeDescription,
   createSubmitRunSlot,
   descriptionMaxLength,
@@ -89,22 +88,22 @@ describe("stale upload ids are dropped after the server refuses them", () => {
 describe("the description field leaves room for the flag notes", () => {
   it("keeps a full-length description plus both flags inside the contract limit", () => {
     const max = descriptionMaxLength(BOTH_FLAGS)
-    expect(max).toBeLessThan(REPORT_DESCRIPTION_MAX)
+    expect(max).toBeLessThan(MAX_REPORT_DESCRIPTION_LENGTH)
     const composed = composeDescription({ description: "x".repeat(max), flags: BOTH_FLAGS })
-    expect(composed?.length).toBe(REPORT_DESCRIPTION_MAX)
+    expect(composed?.length).toBe(MAX_REPORT_DESCRIPTION_LENGTH)
     expect(CreateReportRequestSchema.shape.description.safeParse(composed).success).toBe(true)
     const over = composeDescription({ description: "x".repeat(max + 1), flags: BOTH_FLAGS })
     expect(CreateReportRequestSchema.shape.description.safeParse(over).success).toBe(false)
   })
 
   it("gives the whole budget back when no flag is on, and matches each single flag exactly", () => {
-    expect(descriptionMaxLength(NO_FLAGS)).toBe(REPORT_DESCRIPTION_MAX)
+    expect(descriptionMaxLength(NO_FLAGS)).toBe(MAX_REPORT_DESCRIPTION_LENGTH)
     for (const flags of [
       { blockingSidewalk: true, safetyHazard: false },
       { blockingSidewalk: false, safetyHazard: true },
     ]) {
       const composed = composeDescription({ description: "x".repeat(descriptionMaxLength(flags)), flags })
-      expect(composed?.length).toBe(REPORT_DESCRIPTION_MAX)
+      expect(composed?.length).toBe(MAX_REPORT_DESCRIPTION_LENGTH)
     }
   })
 })
diff --git a/packages/ui/src/report/draftStore.ts b/packages/ui/src/report/draftStore.ts
index 3a8d4a7f..374f8f8d 100644
--- a/packages/ui/src/report/draftStore.ts
+++ b/packages/ui/src/report/draftStore.ts
@@ -1,4 +1,5 @@
 import { create } from "zustand"
+import { MAX_REPORT_MEDIA } from "@civfix/shared"
 import type { CapturedMedia } from "../capabilities"
 import { registerViewerScopedDrafts } from "../viewerScope"
 import { randomId } from "../data/randomId"
@@ -71,8 +72,6 @@ interface DraftReportState {
   reset: () => void
 }
 
-export const MAX_DRAFT_MEDIA = 5
-
 const EMPTY_FLAGS: DraftFlags = {
   blockingSidewalk: false,
   safetyHazard: false,
@@ -254,7 +253,7 @@ export const useDraftReportStore = create<DraftReportState>((set, get) => ({
       return {
         draft: {
           ...s.draft,
-          media: [...s.draft.media, added].slice(0, MAX_DRAFT_MEDIA),
+          media: [...s.draft.media, added].slice(0, MAX_REPORT_MEDIA),
           ...(becomesLocationSource && media.location
             ? {
                 lat: media.location.lat,
@@ -272,7 +271,7 @@ export const useDraftReportStore = create<DraftReportState>((set, get) => ({
     set((s) => ({
       draft: {
         ...s.draft,
-        media: [...s.draft.media, { id: randomId(), ...media }].slice(0, MAX_DRAFT_MEDIA),
+        media: [...s.draft.media, { id: randomId(), ...media }].slice(0, MAX_REPORT_MEDIA),
       },
     })),
   removeMedia: (idOrUri) =>
diff --git a/packages/ui/src/report/submit.ts b/packages/ui/src/report/submit.ts
index ee1fd03a..1b90793c 100644
--- a/packages/ui/src/report/submit.ts
+++ b/packages/ui/src/report/submit.ts
@@ -1,4 +1,4 @@
-import { AppError, ErrorCode, appErrorCode, appErrorFields } from "@civfix/shared"
+import { AppError, ErrorCode, MAX_REPORT_DESCRIPTION_LENGTH, appErrorCode, appErrorFields } from "@civfix/shared"
 import type { ApiClient } from "@civfix/shared/client"
 import type { CreateReportRequest, ReportCategory, ReportType } from "@civfix/shared"
 import { useCallback } from "react"
@@ -26,10 +26,6 @@ import { registerViewerScopedDrafts } from "../viewerScope"
 import { useDraftReportStore } from "./draftStore"
 import type { DraftFlags, DraftMedia, DraftReport } from "./draftStore"
 
-// Mirrors CreateReportRequestSchema's `description` max(2000); the composed text (typed description plus
-// the flag notes) is what the server measures.
-export const REPORT_DESCRIPTION_MAX = 2000
-
 const DESCRIPTION_NOTE_SEPARATOR = "\n\n"
 
 function flagNotes(flags: DraftFlags): string {
@@ -51,11 +47,13 @@ export function composeDescription(draft: Pick<DraftReport, "description" | "fla
   return out.length > 0 ? out : undefined
 }
 
+// The composed text (typed description plus the flag notes) is what the server measures against
+// MAX_REPORT_DESCRIPTION_LENGTH, not the typed description alone.
 export function descriptionMaxLength(flags: DraftFlags): number {
   const notes = flagNotes(flags)
   return notes.length > 0
-    ? REPORT_DESCRIPTION_MAX - DESCRIPTION_NOTE_SEPARATOR.length - notes.length
-    : REPORT_DESCRIPTION_MAX
+    ? MAX_REPORT_DESCRIPTION_LENGTH - DESCRIPTION_NOTE_SEPARATOR.length - notes.length
+    : MAX_REPORT_DESCRIPTION_LENGTH
 }
 
 // The server names only the array, not the id it could not claim (expired, swept, or already bound), so
diff --git a/packages/ui/src/share/__tests__/shareToDm.test.ts b/packages/ui/src/share/__tests__/shareToDm.test.ts
index 728daf4a..397d4c7d 100644
--- a/packages/ui/src/share/__tests__/shareToDm.test.ts
+++ b/packages/ui/src/share/__tests__/shareToDm.test.ts
@@ -1,7 +1,6 @@
 import { describe, expect, it } from "vitest"
-import { MESSAGE_BODY_MAX, type MessageThreadDTO } from "@civfix/shared"
+import { MESSAGE_BODY_MAX, WS_CLIENT_ID_MAX, type MessageThreadDTO } from "@civfix/shared"
 import {
-  SHARE_CLIENT_ID_MAX,
   SHARE_DM_MAX_RECIPIENTS,
   applyRecipientChange,
   buildSharePlan,
@@ -122,7 +121,7 @@ describe("buildSharePlan", () => {
 
   it("clamps a clientId to the 64 characters the socket frame accepts", () => {
     const plan = buildSharePlan([toShareRecipient(person("a"))], () => "z".repeat(200))
-    expect(plan[0]?.clientId).toHaveLength(SHARE_CLIENT_ID_MAX)
+    expect(plan[0]?.clientId).toHaveLength(WS_CLIENT_ID_MAX)
   })
 })
 
diff --git a/packages/ui/src/share/shareToDm.ts b/packages/ui/src/share/shareToDm.ts
index f8be9d23..d3636645 100644
--- a/packages/ui/src/share/shareToDm.ts
+++ b/packages/ui/src/share/shareToDm.ts
@@ -1,12 +1,10 @@
-import { MESSAGE_BODY_MAX, type MessageThreadDTO, type PersonDTO } from "@civfix/shared"
+import { MESSAGE_BODY_MAX, WS_CLIENT_ID_MAX, type MessageThreadDTO, type PersonDTO } from "@civfix/shared"
 import { threadRoomId } from "../data/threadRoom"
 
 export const SHARE_DM_MAX_RECIPIENTS = 10
 
 export const SHARE_DM_RECENT_LIMIT = 20
 
-export const SHARE_CLIENT_ID_MAX = 64
-
 export interface ShareRecipient {
   id: string
   name: string
@@ -78,7 +76,7 @@ export function buildSharePlan(
     seen.add(recipient.id)
     entries.push({
       recipient,
-      clientId: newClientId(entries.length).slice(0, SHARE_CLIENT_ID_MAX),
+      clientId: newClientId(entries.length).slice(0, WS_CLIENT_ID_MAX),
     })
     if (entries.length === max) break
   }