diff --git a/.claude/commands/pr.md b/.claude/commands/pr.md
new file mode 100644
index 00000000..f15e41da
--- /dev/null
+++ b/.claude/commands/pr.md
@@ -0,0 +1,6 @@
+---
+description: Create or update a pull request (delegates to the `pr` skill)
+allowed-tools: Skill
+---
+
+Invoke the `pr` skill to handle this request. The skill covers both creating a new PR and updating an existing one's description, including frontend screenshot capture when the diff warrants it.
diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 00000000..9e4442c7
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,3 @@
+{
+  "enabledMcpjsonServers": ["playwright"]
+}
diff --git a/.claude/skills/frontend-conventions/SKILL.md b/.claude/skills/frontend-conventions/SKILL.md
new file mode 100644
index 00000000..2bed3363
--- /dev/null
+++ b/.claude/skills/frontend-conventions/SKILL.md
@@ -0,0 +1,86 @@
+---
+name: frontend-conventions
+description: >-
+  Frontend conventions for this project — the `Form::Group`/`Form::Input`
+  components for form fields, the `twlink` class for basic links, the
+  `number_display` helper for numbers, the `UI::Time::Component` for times,
+  the UI component library rule (buttons are `UI::Button`/`UI::ButtonLink`
+  — check `app/components/ui/` and `app/components/form/` before
+  hand-rolling markup), the shared collapse helpers for showing/hiding
+  elements, and ViewComponent rules (keyword arguments, instance
+  variables, `helpers.` prefix in templates). Trigger when adding or modifying views
+  (`.html.erb`), view components, Stimulus controllers, Tailwind classes,
+  or any frontend code that touches styling or interactivity. **Also
+  trigger before any `mcp__playwright__browser_take_screenshot` call** —
+  this skill defines the required `tmp/` filename rule so screenshots
+  don't land in the project root. Stimulus.js is the JavaScript framework.
+---
+
+# Frontend conventions
+
+This project uses **Stimulus.js** for JavaScript interactivity and **Tailwind CSS** for styling.
+
+The `bin/dev` command runs `bin/rails tailwindcss:watch` (see `Procfile.dev`) to build and update Tailwind CSS. JS is served directly via importmap (`config/importmap.rb`, `app/javascript/`) — there's no separate JS build step.
+
+**Format ERB before committing.** After editing any `.html.erb`, run `bin/lint <file>` — it runs `herb-format`, which reflows long `class` attributes and normalizes ERB. CI does *not* run the herb steps (`.github/workflows/ci.yml` only calls `standardrb`, `rubocop`, and `bin/brakeman`), so unformatted ERB won't fail the build — run `bin/lint` anyway to keep formatting consistent. It needs `yarn install` to have run, since the herb tools come from `devDependencies`.
+
+## Standard classes and helpers
+
+- Form fields should be rendered through `Form::Group::Component` (label + input, `app/components/form/group`) or `Form::Input::Component` directly (`app/components/form/input`) — not hand-rolled `<input>`/`<label>` tags with ad-hoc classes. `Form::Group::Component` applies the shared label classes and delegates the field to `Form::Input::Component`, which centralizes the input's Tailwind classes.
+- Basic links should use the `twlink` class.
+- **Every number** should be rendered with `number_display(number)` (defined in `app/helpers/application_component_helper.rb`). This applies even when a number is composed into a string with non-numeric values — wrap the number itself, not the surrounding string.
+  - Good: `[number_display(user.year_joined), user.name].join(" ")`
+  - Bad: `[user.year_joined, user.name].join(" ")`
+  - "Number" includes years, counts, prices, distances, IDs — anything numeric, even when it reads like a label.
+- **Times** should be rendered with `UI::Time::Component` rather than `time_ago_in_words` or raw `strftime`.
+- **Horizontally-scrolling containers (`overflow-x-auto`/`overflow-x-scroll`) must bleed to their parent's edges**, with the parent's own horizontal padding reapplied on the scrollable element itself: cancel the parent's `px-N` with `-mx-N` on the scroller, then add that same `px-N` back on the scroller. This keeps the at-rest look identical (content still starts inset) but lets the scroll track — and touch/scroll gestures — reach the container's true edges instead of stopping short inside a padded dead zone. See `UI::Table::Component`'s wrapper (`-mx-4 … px-4`) for the pattern in practice.
+  - Good: parent has `p-4`; scroller has `class="-mx-4 flex gap-4 overflow-x-auto px-4"`.
+  - Bad: scroller sits inside the parent's padding with no margin adjustment — it never reaches the edge, so gestures starting at the edge miss it and there's no partial-next-item peek.
+
+## Use the UI component library
+
+**Check `app/components/ui/` (and `app/components/form/`) before hand-rolling any UI primitive.** If a `UI::*`/`Form::*` component exists for the pattern — buttons, dropdowns, badges, modals, pagination, tables, alerts — use it; if it almost fits, extend it rather than forking its markup inline. A hand-styled one-off silently drifts from the shared colors/sizes/dark-mode states the next time the design changes.
+
+- **Every button** goes through `UI::Button::Component` — never a bare `<button>` or submit input with ad-hoc Tailwind classes. It centralizes the colors (`:primary`/`:secondary`/`:error`/`:link`), sizes (`:sm`/`:md`/`:lg`), and the focus/active/dark-mode states.
+- A link styled as a button is `UI::ButtonLink::Component.new(href:, text:, color:, size:)` — same palette, renders an `<a>` via `link_to`.
+
+## Showing and hiding elements: use the collapse helpers
+
+Any time you show, hide, or toggle an element in response to interaction, go through the shared collapse helpers. **Never** hand-roll it with the `hidden` attribute, `element.style.display`, `element.hidden = true`, or ad-hoc `classList.add('hidden')` — those skip the shared show/hide animation and the `hidden!`/`hidden` class contract the rest of the app depends on.
+
+- **Markup-only toggle** (a trigger reveals/collapses a panel, no other logic): add `data-controller="collapse"`, mark the collapsible element `data-collapse-target="content"`, and wire the trigger's `data-action` to `collapse#toggle` / `collapse#show` / `collapse#hide` (`app/javascript/controllers/collapse_controller.js`; optional `data-collapse-duration-value`).
+- **Inside your own Stimulus controller** (you have extra logic — a redirect branch, a query-param check, etc.): import the collapse util and call it directly:
+
+  ```js
+  import { collapse } from 'utils/collapse_utils'
+  // ...
+  collapse('show', this.formTarget)   // 'show' | 'hide' | 'toggle'; optional duration (default 200)
+  ```
+
+The collapsible element starts hidden with the **`hidden` class** (not the `hidden` attribute) — `collapse` toggles `hidden`/`hidden!` and runs the height transition for you. Because the initial hidden state is a class, component specs assert it by class (`have_css("[…].hidden")`), not Capybara visibility — the rack_test driver doesn't evaluate CSS, so it can't tell a class-hidden element is hidden.
+
+## No dead hooks in markup
+
+Only add an `id` or non-utility `class` when something concrete consumes it — a CSS rule, a JS/Stimulus selector, a test fixture, an accessibility attribute. Don't keep or invent "structural identifier" hooks "in case something needs them later," and don't replace a removed hook with a renamed one out of inertia.
+
+When deleting an `id`/`class`, grep the repo for the name before deciding what to do with it:
+
+- Zero consumers: delete it, don't rename it.
+- Consumers exist: either update them, or leave the hook in place — the consumers are the *reason* it earns its spot in the markup.
+
+## ViewComponent rules
+
+This project uses the ViewComponent gem to render components.
+
+- **Prefer view components to partials.**
+- Generate a new view component with `rails generate component ComponentName argument1 argument2`.
+- View components must initialize with **keyword arguments**. Everything the component needs must be passed in explicitly by the caller — never reach into controller state from inside a component (e.g. `controller.instance_variable_get(:@user)`). If the component needs `@user`, the caller renders `Component.new(user: @user)`.
+- In view components, **use instance variables directly** — don't add `attr_reader`/`attr_accessor`. Reference `@foo` everywhere, including in the template.
+- In ViewComponent templates, use the `helpers.` prefix for view helpers (e.g. `helpers.current_page_active?`, from `ApplicationHelper`).
+  - Rule of thumb: try the bare call first. Only add `helpers.` if it fails with `NoMethodError` — route helpers (`user_path`, `new_user_session_path`) and ActionView tag/url builders (`tag.span`, `content_tag`, `link_to`, `button_to`, `url_for`) are mixed into `ViewComponent::Base` directly, so they don't need it.
+- **Never nest a component inside a folder that already holds a `component.rb`.** Each component lives in `app/components/<path>/component.rb` (and `spec/components/<path>/component_spec.rb`); siblings go in sibling folders, not subfolders. If you have `ui/dropdown/component.rb` and need a related component, place it at `ui/dropdown_item/component.rb` (module `UI::DropdownItem`), not `ui/dropdown/item/component.rb`.
+- **Converting a partial to a component is a faithful move, not a cleanup.** Carry the markup over verbatim — including comments and commented-out code, which are often a deliberate stash someone expects to restore. The only changes a conversion should introduce are the mechanical ones the move *requires* (e.g. adding `helpers.` where a helper now needs it). If you spot genuine dead code worth removing, that's a separate judgment call — raise it or do it in its own commit, don't fold it into the move.
+
+## Manual browser verification
+
+**Every `mcp__playwright__browser_take_screenshot` call must pass a `filename:` that starts with `tmp/`** (e.g. `tmp/tooltip-hover.png`). The MCP tool's default root is the project root — a bare filename like `tooltip.png` lands in the working tree, shows up in `git status`, and has to be cleaned up by hand. `tmp/` is gitignored, so screenshots there stay out of commits and don't pollute the diff. This rule applies to ad-hoc visual verification, not just PR-screenshot capture.
diff --git a/.claude/skills/frontend-screenshots/SKILL.md b/.claude/skills/frontend-screenshots/SKILL.md
new file mode 100644
index 00000000..4b2f54c7
--- /dev/null
+++ b/.claude/skills/frontend-screenshots/SKILL.md
@@ -0,0 +1,91 @@
+---
+name: frontend-screenshots
+description: >-
+  Capture desktop+mobile viewport screenshots of local pages served by
+  `bin/dev` via Playwright MCP, with a PII safety check that keeps real
+  data out of uploaded images. Use whenever a task needs screenshots of local
+  pages — PR documentation, bug repros, before/after comparisons across
+  branches, design review, demos — including mid-interaction states like an
+  open dropdown, a modal showing, a form mid-fill, or a hover. Use it even when
+  the user just says "grab a screenshot" or "show me what this looks like"
+  without naming Playwright. For a component that only renders under an env var
+  / feature flag / hard-to-reach state, screenshot its Lookbook preview URL
+  instead of a full page. Inputs: `(url-path, page-slug)` pairs, optionally with
+  per-URL interaction steps. Output: local PNG paths.
+allowed-tools: Bash, Read, ToolSearch, mcp__playwright__*
+---
+
+# Frontend screenshots
+
+Drive Playwright MCP to capture viewport screenshots of pages served by `bin/dev`.
+
+## Output filenames (load-bearing — callers parse these)
+
+`tmp/pr_screenshots/<branch>-<page>-<timestamp>-{desktop,mobile}.png`, where `<branch>=$(git rev-parse --abbrev-ref HEAD | tr '/' '-')` and `<timestamp>=$(date +%Y%m%d-%H%M%S)`. Cross-branch shots get an extra `-main-` segment.
+
+## Preflight
+
+- `eval "$(ruby bin/env --export)"` so `$WORKSPACE_ID`, `$DEV_PORT`, `$BASE_URL`, and `$REDIS_URL` are set. **Each Bash tool call is a fresh shell, so re-export in any shell that reads `$BASE_URL`** — `eval "$(ruby bin/env --export)" && curl …` chained in one call is the safe pattern.
+- `curl -fs "$BASE_URL/" >/dev/null` — if it isn't up, **stop and ask the user to start it** (`bin/dev`). `bin/env` resolves `$DEV_PORT` from the workspace ID in `.workspace_id` (falling back to `3009` in the root checkout), so the `bin/dev` the user starts binds to the same port and databases this skill expects.
+- If `bin/dev` exits immediately with `Could not find 'bundler' (X.X.X)` or similar, the shell resolved system Ruby 2.6 instead of mise-installed 4.0.6 — see the [`sandbox-test-setup`](../sandbox-test-setup/SKILL.md) skill's local-macOS section for the one-line PATH fix; don't reinstall.
+- If `mcp__playwright__*` tools aren't registered, the project's `.mcp.json` defines the `playwright` server — approve it on project entry (Claude Code prompts) and restart the session, or `/mcp` → **playwright** → reconnect. A server added mid-session doesn't load until restart.
+
+## Sign in (when needed)
+
+The MCP browser session persists across calls, so signing in is a one-time-per-session step. For public pages (the root page, Lookbook previews at `/lookbook/...`, etc.), skip this entirely. **Only ever authenticate against the local dev server** (`$BASE_URL` / localhost) — never sign in to any other host, and never create, promote, or impersonate users to bypass auth.
+
+`db/seeds.rb` is the stock empty Rails template — convus_webapp doesn't seed any users, so there's no fixed credential to drive Playwright with. When a navigation lands on `/users/sign_in`, ask the user for an email/password to sign in with (and which role, if it matters: `User#role` is `basic_user`, `developer`, or `admin` — `admin_access?` is true for `developer` or `admin`, and gates `/admin/...` routes). Fill `Email` + `Password` and click `Log in`; the post-login redirect dumps you on `/` (or the originally-requested path if Devise stored it).
+
+**Don't upload real PII.** Screenshots are permanent once uploaded. Even when signed in, if a page shows records that don't look like test data (unfamiliar names/emails, real-looking user content), stop and ask — the dev DB may have been loaded with production data.
+
+## Capture
+
+Clear stale shots: `rm -f tmp/pr_screenshots/<branch>-<page>-*.png 2>/dev/null || true`.
+
+Two viewports — resize once each, then walk every URL:
+1. `browser_resize` 1440×900 → for each URL: navigate → settle → `browser_take_screenshot` (`fullPage: true`) to `...-desktop.png`.
+2. `browser_resize` 390×844 → same loop → `...-mobile.png`.
+
+**Pass the path as workspace-relative**, e.g. `tmp/pr_screenshots/<branch>-<page>-<ts>-desktop.png`. Playwright MCP rejects absolute paths that escape the workspace root with `File access denied: … is outside allowed roots`.
+
+**Full page, no `target:` arg.** Capture the whole page (`fullPage: true`) so nothing below the fold is cut off. convus_webapp's layout (`app/views/layouts/application.html.erb`) has no site footer, so there's nothing to hide before the shot.
+
+Element-only crops (`target:`) still slice context off — don't use them for page captures.
+
+**Settle before the screenshot.** Stimulus + Chartkick render after document load; either `browser_wait_for` on a known element or pause ~500ms–1s. Otherwise charts capture mid-draw.
+
+**Mid-interaction states are in scope.** When the caller asks for a dropdown open, a modal showing, a hover state, a partially-filled form, etc., drive Playwright between settle and the screenshot — `browser_click`, `browser_type`, `browser_press_key`, `browser_hover`, then wait for the UI to reach the target state (`browser_wait_for` on a marker element, or check via `browser_evaluate`) before `browser_take_screenshot`. Treat the interaction sequence as part of the page-slug — e.g. capture `dropdown-open` after clicking, distinct from a static page-load shot. For cross-branch comparisons, run the *same* interaction sequence on each branch so the screenshots actually compare like-for-like.
+
+Sanity-check each PNG: under ~5 KB usually means the page errored. Pull `browser_console_messages` and look only for **uncaught exceptions from app code** (Stimulus registration failures, `TypeError`s in `app/javascript/**`) — asset 404s and third-party deprecation warnings are noise. To diagnose a failed capture: HTTP status via `curl -s -o /dev/null -w "%{http_code}\n" "$BASE_URL/<path>"`, response body via `curl -s "$BASE_URL/<path>" | head -200`, full backtrace via `tail -200 log/development.log`.
+
+Only stop and surface to the user once you understand the cause and either (a) have a fix to propose, (b) need input they must provide (e.g. which URL to screenshot instead), or (c) concluded it's a real bug in the diff.
+
+## Component previews (when no page shows the state)
+
+Some components only render in a context you can't reproduce on a normal dev page — gated by an env var, a feature flag, or a hard-to-reach error/empty state. When a component has a Lookbook preview, screenshot the **preview URL** instead of hunting for a page that happens to render it:
+
+```
+$BASE_URL/lookbook/preview/<preview_path>/<scenario>
+```
+
+`<preview_path>` is the component's module nesting underscored (drop the `ComponentPreview` suffix), and `<scenario>` is the preview method. `UI::Dropdown::ComponentPreview#placements` → `/lookbook/preview/ui/dropdown/placements`. If a scenario doesn't exist yet, add a method to the component's `*_preview.rb` first — a preview that renders the exact state (pass the args that trigger it) is often the fastest path to a clean shot.
+
+The preview page loads Tailwind and renders the component standalone (no site chrome), so capture the viewport as usual (`fullPage: false`); a small render-timing line at the bottom is harmless. Everything else still applies — same PII caution, same `(url-path, page-slug)` naming (use a slug like `dropdown-placements`).
+
+convus_webapp's component previews render from static sample data (`OpenStruct` records, hardcoded chart series) rather than the dev DB, so there's no seed step before a preview renders. This is component-only: a preview can't show layout/stacking against the rest of the page (e.g. a navbar z-index fix), so use a real page for those.
+
+## Cross-branch comparison (optional)
+
+When the caller wants before/after, repeat the capture loop against `main`.
+
+1. `git status` — abort if there are uncommitted changes.
+2. Diff `db/migrate/` between the branch and `main`; abort if it changed — a branch-only migration leaves the DB schema ahead of `main`'s code, so `main` pages can error.
+3. `BRANCH=$(git rev-parse --abbrev-ref HEAD)`, `git checkout origin/main` (detached — `git checkout main` fails if a sibling worktree holds the `main` branch; detached HEAD at `origin/main` is allowed concurrently and is the same code), navigate the browser to force Rails to reload the changed files, repeat capture into `...-main-...` filenames, then `git checkout $BRANCH`.
+
+A `Gemfile.lock` diff is **not** a reason to abort.
+
+The dev DB persists across checkouts, so any signed-in session usually still works.
+
+## Clean up
+
+Once every screenshot is captured, quit Chrome with `browser_close`. Leaving it running holds the shared browser profile lock, so the next `browser_navigate` (this skill or another) fails with "Browser is already in use". Always close it before returning, even if the capture failed partway.
diff --git a/.claude/skills/github-upload-image-to-pr/SKILL.md b/.claude/skills/github-upload-image-to-pr/SKILL.md
new file mode 100644
index 00000000..6e7f8fde
--- /dev/null
+++ b/.claude/skills/github-upload-image-to-pr/SKILL.md
@@ -0,0 +1,184 @@
+---
+name: github-upload-image-to-pr
+description: >-
+  Embed a local image file into an existing GitHub PR — either in the PR body or as a comment.
+  Trigger when a request pairs a local image (screenshot, .png/.jpg, CleanShot capture, before/after)
+  with an existing PR (by #number, URL, branch name, or "the open PR"), regardless of verb —
+  attach, embed, add, put, post, drop, show, document. Also covers visually documenting test runs,
+  bug repros, UI states, or CI failures on an existing PR. The `gh` CLI cannot upload images;
+  this skill drives a real browser to GitHub's user-attachments uploader.
+allowed-tools: Bash, Read, Write, ToolSearch, mcp__playwright__*
+---
+
+# Upload Image to PR
+
+Browser-driven workflow for embedding local images in a GitHub PR — the GitHub API does not support image uploads, so this drives Playwright MCP to GitHub's user-attachments uploader instead.
+
+## How It Works
+
+Since the GitHub API does not support direct image uploads, this skill uses the **PR comment textarea as a staging area for GitHub's image hosting** — uploading files there to obtain persistent `user-attachments/assets/` URLs, then updating the PR description or posting a comment via the `gh` CLI.
+
+## Step 1: Resolve PR context
+
+If the user didn't specify a PR number or URL, auto-detect it:
+
+```bash
+# Get PR number from the current branch
+gh pr view --json number,url -q '"\(.number) \(.url)"'
+```
+
+If multiple repos or branches are involved, confirm with the user which PR to target.
+
+Also, normalize the image paths to absolute paths. If a path contains special characters (e.g., Unicode narrow spaces from CleanShot X), copy the file to `/tmp/` first:
+
+```bash
+# e.g., to handle glob-matched paths with special chars
+cp /path/to/CleanShot*keyword*.png /tmp/screenshot.png
+```
+
+## Step 2: Verify Playwright MCP is available
+
+Use `ToolSearch` with a query like `"browser navigate upload"` to confirm `mcp__playwright__*` tools are registered.
+
+Playwright MCP runs isolated (`--isolated --storage-state=…/mcp-auth.json`), loading github.com cookies from that shared storage-state file at startup — so the session persists across sessions once the file is populated. It's load-only: the MCP never writes it back, so login can't be refreshed through the MCP browser. If GitHub logs the user out and you hit a 404 / login screen mid-task, see [references/headless-relogin.md](references/headless-relogin.md) — full login can't be driven headlessly.
+
+### If Playwright MCP is not registered
+
+The project ships a `.mcp.json` registering Playwright MCP (isolated, shared storage-state file, headless). Claude Code prompts to approve project MCP servers on first entry — if the `mcp__playwright__*` tools aren't registered, approve the `playwright` server there and restart the session (or `/mcp` → **playwright** → **reconnect**). On first use `mcp-auth.json` won't exist yet — populate it via the login helper in the re-login guide.
+
+## Step 3: Navigate to PR page and check login state
+
+Navigate and immediately take a snapshot to verify login state:
+
+```js
+browser_navigate({ url: "https://github.com/{owner}/{repo}/pull/{number}" })
+browser_snapshot()
+```
+
+**If an SSO authentication screen appears:** locate the "Continue" button in the snapshot and click it.
+
+## Step 4: Locate the file upload input
+
+Take a snapshot and scroll to the bottom to find the comment area. GitHub renders a file upload input in the comment form. Either find the `ref` directly from the snapshot, or run JS to detect it (GitHub's UI can change — try selectors in order):
+
+```javascript
+() => {
+  const selectors = [
+    'input[type="file"][id*="comment"]',
+    'input[type="file"][id="fc-new_comment_field"]',
+    '#new_comment_field',
+    'input[type="file"]'
+  ];
+  for (const sel of selectors) {
+    const el = document.querySelector(sel);
+    if (el) return { found: true, id: el.id, selector: sel };
+  }
+  return { found: false };
+}
+```
+
+## Step 5: Upload images one by one
+
+The `<input type="file">` from step 4 is **CSS-hidden** — calling `browser_file_upload` against its ref directly fails with "can only be used when there is related modal state present." First click the visible **"Paste, drop, or click to add files"** button (or "Attach files" toolbar icon) on the comment form to open the native file chooser, then `browser_file_upload` will satisfy that chooser.
+
+Upload each image with `browser_file_upload` (takes the element ref and a file paths array). Wait **2–3 seconds between uploads** so GitHub can process each file, then **3–5 seconds after the last upload** before reading URLs in step 6 — GitHub injects the image markup asynchronously after each file finishes processing.
+
+For multiple images, upload them all to the same comment textarea before extracting URLs — this is more efficient than navigating between uploads.
+
+**Important:** Always use absolute file paths.
+
+## Step 6: Retrieve uploaded image URLs
+
+Read the textarea value via `browser_evaluate` — GitHub injects either markdown or HTML referencing the upload after each file finishes processing.
+
+The **standard textarea selector** (referenced again in step 7) prefers the known ID and falls back to a substring match in case GitHub renames it:
+
+```javascript
+() => {
+  const ta = document.getElementById('new_comment_field')
+          || document.querySelector('textarea[id*="comment"]');
+  return ta ? ta.value : 'textarea not found';
+}
+```
+
+GitHub may inject **either form** depending on image dimensions / file type:
+```
+![image](https://github.com/user-attachments/assets/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
+<img width="..." height="..." alt="..." src="https://github.com/user-attachments/assets/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" />
+```
+
+Both render the image in the PR — preserve whichever form GitHub used. If you need to extract just the URL (e.g., to rewrap), match the asset path with a regex that ignores wrapper syntax: `https://github\.com/user-attachments/assets/[0-9a-f-]+`.
+
+## Step 7: Clear the textarea (do not submit the comment)
+
+Submitting via the UI's "Comment" button would post a public comment as a side effect of the upload. The only thing that should determine where the image lands (PR body vs. a new comment) is step 8 — so the textarea here is purely an upload-staging surface, never a submission surface. Clear it, then let `gh pr edit` / `gh pr comment` decide the destination.
+
+Use the **standard textarea selector** from step 6, then assign `ta.value = ""`:
+
+```javascript
+() => {
+  const ta = document.getElementById('new_comment_field')
+           || document.querySelector('textarea[id*="comment"]');
+  if (ta) { ta.value = ""; return "cleared"; }
+  return "textarea not found";
+}
+```
+
+## Step 8: Embed images in the PR
+
+Substitute whichever form (markdown `![](...)` or HTML `<img ...>`) GitHub returned in step 6 — preserve it verbatim instead of rewrapping.
+
+**Post as a comment** (the default). A comment keeps the description tight and skimmable, and avoids re-editing the body (and its notification noise) on every recapture.
+
+If a screenshots comment already exists (one authored by you whose body starts with `## Screenshots`), edit it in place instead of posting a new one:
+```bash
+SCREENSHOT_COMMENT_ID=$(gh api "repos/{owner}/{repo}/issues/$PR_NUMBER/comments" \
+  --jq '.[] | select(.body | startswith("## Screenshots")) | .id' | head -1)
+```
+
+Write the comment body to a temp file:
+```
+## Screenshots
+
+<image markup from step 6>
+```
+
+- If `$SCREENSHOT_COMMENT_ID` is empty: `gh pr comment {PR_NUMBER} --body-file <tmp-comment-file>`.
+- Otherwise: `gh api -X PATCH repos/{owner}/{repo}/issues/comments/$SCREENSHOT_COMMENT_ID -f body="$(cat <tmp-comment-file>)" --jq .html_url`. Don't use `-f body=@<file>` — `gh api`'s `-f` stores the literal string `@<file>` rather than reading it, so the comment gets clobbered with the filename.
+
+Only edit the PR description instead when the user explicitly asks for it:
+```bash
+EXISTING_BODY=$(gh pr view {PR_NUMBER} --json body -q .body)
+
+gh pr edit {PR_NUMBER} --body "$(printf '%s\n\n## Screenshots\n\n%s' "$EXISTING_BODY" "<image markup from step 6>")"
+```
+
+If `$EXISTING_BODY` already contains a `## Screenshots` heading (e.g., on re-runs), this will create a duplicate section. Check first with `grep -q "^## Screenshots" <<< "$EXISTING_BODY"` and either replace the existing section or post as a comment instead.
+
+## Step 9: Verify the result
+
+Reload the page in the Playwright browser and take a screenshot to confirm the images render correctly. **Do not** verify with `curl` — `user-attachments/assets/` URLs return HTTP 302 to a session-signed S3 URL that 403s for unauthenticated clients. The 302 alone confirms the asset exists; the browser-rendered check is the only authoritative "did it display" signal.
+
+## Tips
+
+- **Image sizing**: Control display size via HTML `<img>` tags: `<img width="800" alt="description" src="..." />`
+- **Multiple images**: Upload all images in one session to the same textarea; extract all URLs before clearing
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Not logged in | SSO screen may appear — take snapshot, find "Continue" button, click it. Full GitHub login can't be done headless — see [references/headless-relogin.md](references/headless-relogin.md) |
+| File path with special characters (e.g., Unicode narrow spaces from CleanShot) | Copy file to `/tmp/` with a simple name: `cp /path/CleanShot*keyword*.png /tmp/screenshot.png` |
+| File upload fails | Ensure the file path is absolute |
+| Textarea doesn't contain URLs yet | Wait 3–5 seconds after upload before running JS eval; retry once if needed |
+| Textarea selector not found | GitHub UI changes occasionally — use the multi-selector JS in Step 4 to find the current element |
+| Playwright MCP not registered | Approve the `playwright` server from the project `.mcp.json` (Claude Code prompts on project entry), then restart the session or `/mcp` → reconnect |
+| PR not found / 404 | Private repos return 404 for unauthenticated users — check login state |
+
+## Notes
+
+- GitHub `user-attachments/assets/` URLs are **persistent** — images remain accessible even without submitting the comment
+- Editing the description directly in the browser UI is fragile due to GitHub UI structure changes — updating via `gh pr edit` is strongly preferred
+- Multiple images can be uploaded in a single session before extracting URLs
+- Playwright MCP preserves cookies/login state across calls within a session; across sessions the login comes from the shared `--storage-state` file (`mcp-auth.json`), loaded at startup
diff --git a/.claude/skills/github-upload-image-to-pr/references/headless-relogin.md b/.claude/skills/github-upload-image-to-pr/references/headless-relogin.md
new file mode 100644
index 00000000..b24b171b
--- /dev/null
+++ b/.claude/skills/github-upload-image-to-pr/references/headless-relogin.md
@@ -0,0 +1,36 @@
+# Logging into GitHub when the MCP runs headless
+
+The Playwright MCP is registered in the project's **`.mcp.json`** (inspect with `claude mcp get playwright`) with `--isolated --headless`, seeding each browser session's auth from a storage-state file: `--storage-state=${HOME}/.cache/ms-playwright/mcp-auth.json`. Two consequences:
+
+- The github.com session lives in that file, not in a browser profile. Every new browser session re-reads it at context creation.
+- The file is read-only from the MCP's perspective: `--isolated` keeps the profile in memory and never writes back to disk. A login performed inside the MCP browser is lost when the browser closes — so re-login means **regenerating the state file**, not driving the MCP browser through the login form. (This holds even if the MCP happens to be running headed: an in-browser login lasts only until that browser session ends.)
+
+Confirm the exact `--storage-state` path from `claude mcp get playwright` rather than assuming it — the commands below use `$HOME/.cache/ms-playwright/mcp-auth.json`, the current value.
+
+## When to do this
+
+Hitting a GitHub login screen — or a 404 on a private repo (GitHub returns 404 to unauthenticated users) — means `mcp-auth.json` is missing or its session has expired. Confirm with `browser_snapshot`; never try to drive GitHub's login form blind (credentials, 2FA codes, and passkeys can't be typed into a headless window, and you must not type them for the user anyway).
+
+## Regenerate the storage state
+
+Run a one-shot headed browser that saves storage on close — no MCP config edits, no `/mcp` reconnect dance. This is a user-run login helper, not a screenshot path: screenshots still go only through the MCP, never the Playwright CLI.
+
+```bash
+npx -y playwright open --save-storage="$HOME/.cache/ms-playwright/mcp-auth.json" https://github.com/login
+```
+
+If Playwright's managed Chromium isn't installed, the command errors with an install hint — either run `npx playwright install chromium` first, or append `--browser=chrome` to use the system Chrome instead.
+
+1. The command blocks until the browser is closed, so launch it in the background (or ask the user to run it in their own terminal).
+2. A visible browser window opens at the GitHub login page. The user signs in themselves — credentials, 2FA, passkey. **Do not type their credentials for them.**
+3. When the user closes the browser window, cookies and localStorage are written to `mcp-auth.json`.
+
+## Pick up the new state
+
+1. `browser_close` — the current MCP browser session was created from the stale state.
+2. `browser_navigate` to `https://github.com`, then `browser_snapshot` — the fresh isolated context re-reads `mcp-auth.json`. Confirm the account sidebar shows the user's handle.
+3. If it still shows logged-out, ask the user to run `/mcp` → **playwright** → **reconnect**, then repeat step 2.
+
+## Mid-task
+
+If you hit a 404 / login screen mid-task, **stop**, regenerate the state file as above, pick up the new state, then resume the task.
diff --git a/.claude/skills/integration-testing/SKILL.md b/.claude/skills/integration-testing/SKILL.md
new file mode 100644
index 00000000..3d246df1
--- /dev/null
+++ b/.claude/skills/integration-testing/SKILL.md
@@ -0,0 +1,171 @@
+---
+name: integration-testing
+description: >-
+  Conventions for browser specs (`type: :system, :js`) in this project
+  — every example pays a Selenium boot cost, so bias hard toward fewer,
+  denser examples that walk through state via clicks, prefer
+  named-element matchers over CSS selectors or `execute_script`, and
+  combine same-setup work into one `it` even when scenarios feel
+  independent. **Consult this skill any time you create or modify a
+  `:js, type: :system` spec** — in this project that means component
+  system specs at `spec/components/**/component_system_spec.rb`, the
+  only browser specs this codebase has (there is no `spec/integration/`
+  directory). Read alongside the `rspec-testing` skill for the project's
+  general `context`/`let` style.
+---
+
+# Integration testing
+
+Browser specs (`type: :system, :js`) in this project are component-level interaction specs at `spec/components/**/component_system_spec.rb` — there is no separate feature-flow directory (`spec/integration/` doesn't exist here). They run full Chrome sessions via Capybara/Selenium (`driven_by :selenium, using: :headless_chrome`, configured in `spec/rails_helper.rb`) and pay a real Selenium boot cost per example, so optimize for fewer, denser examples and high-level Capybara helpers.
+
+The general `context`/`let` style and "what to test" rules are in the [`rspec-testing`](../rspec-testing/SKILL.md) skill — the rules below extend it for the system-spec case.
+
+## Always follow the real user path
+
+If a user does it in the UI, the spec does it in the UI — every step, including setup. `FactoryBot.create(:user, …)` to skip a complicated form turns the spec back into a model test and passes silently when the form is broken.
+
+If the UI path is hard or flaky, that's a real signal — usually a production bug (stale asset cache, missing seed data, wrong API URL). Fix the root cause; don't `execute_script` or factory around it.
+
+Legitimate exceptions: reference data that exists in production via seeds/migrations, admin accounts outside the user flow, and stubs for genuinely external services (third-party APIs, geocoders).
+
+## One `it` per setup; many assertions per `it`
+
+Unit specs prefer one assertion per example. **Integration specs prefer the opposite**: when several assertions share the same fixture and the same initial `visit`, fold them into one example that walks through state transitions (click → assert → click → assert).
+
+Use `context` only when the *setup* differs — a different `let!`, a different page, a different feature flag. Don't split a single user flow across sibling `it` blocks just because each step has its own assertion.
+
+**Combine same-setup work, even when scenarios feel independent.** Before writing a new `describe`/`context`/`it`, read the existing file and find an example whose fixtures and initial `visit` match what you need — then append your clicks/assertions to it. It's tempting to leave a separate `it` for things that feel like different concerns ("button-state test", "filter-persistence test", "URL-param test", "mobile-layout test"). Don't. A long, sectioned-with-comments example pays one Selenium boot; four short examples pay four. Failure attribution is fine — the failed line number tells you exactly which phase broke. Only add a new block when the setup genuinely differs.
+
+### Good
+
+```ruby
+it "signs up and lands on the home page" do
+  visit new_user_registration_path # no signup link on the home page nav — this is the real entry point
+
+  fill_in "Email", with: "newuser@example.com"
+  fill_in "Username", with: "testuser"
+  fill_in "Password", with: "securepassword123"
+  click_button "Sign up"
+
+  expect(page).to have_current_path(root_path)
+  expect(page).to have_link("testuser") # nav now shows the signed-in user
+
+  user = User.find_by(email: "newuser@example.com")
+  expect(user).to have_attributes(username: "testuser")
+end
+```
+
+### Bad
+
+```ruby
+# Two browser sessions for what's effectively one user flow.
+it "creates a user from the signup form" do
+  visit new_user_registration_path
+  fill_in "Email", with: "newuser@example.com"
+  fill_in "Username", with: "testuser"
+  fill_in "Password", with: "securepassword123"
+  click_button "Sign up"
+  expect(User.find_by(email: "newuser@example.com")).to be_present
+end
+
+it "redirects to the home page after signup" do
+  visit new_user_registration_path
+  # ... fill and submit again
+  expect(page).to have_current_path(root_path)
+end
+```
+
+## Carry state forward, don't reset between phases
+
+You know what state the page is in after each click — write the next assertion against that state. Don't click a "Reset" / "Clear" between phases just to get a clean slate; resets cost a click (often two — clear, then re-establish), obscure what's actually happening, and tempt you to think of each phase as an isolated scenario rather than as one continuous user flow.
+
+If a carried-over state makes the next assertion awkward, that's information: usually you can reorder or rephrase phases so the previous phase's end state is exactly what the next phase needs to start from. Treat the example as a flow with state advancing through it, not a sequence of independent scenarios each demanding a pristine baseline.
+
+`visit page.current_url` is a reload, not a reset — use it specifically to verify URL persistence across a fresh page load. Otherwise, prefer letting state flow.
+
+## Navigate by clicking, not re-visiting
+
+After the initial `visit` in `before`, prefer **clicking** to get to the next state. Re-visiting bypasses the very thing system specs exist to verify (client-side state, JS handlers, history, ARIA wiring).
+
+Re-visit only when you specifically want to verify **URL persistence / reload behavior** — and make that intent explicit (`visit page.current_url` with a comment, or a context named "after reload").
+
+```ruby
+# Good — drive the flow with clicks after the initial visit
+visit new_user_registration_path
+fill_in "Email", with: "newuser@example.com"
+fill_in "Username", with: "testuser"
+fill_in "Password", with: "securepassword123"
+click_button "Sign up"
+click_link "testuser" # go to your own ratings — don't re-visit the URL directly
+
+# Good — explicit reload to verify URL persistence
+visit page.current_url
+
+# Bad — re-rendering that should have been a click
+visit ratings_path(user: user.to_param)
+```
+
+## Prefer named matchers over CSS selectors and JS
+
+Capybara's high-level helpers find elements by visible role + text. They are more readable, more accessible (they only see what a real user can interact with), and less brittle than scraping selectors. Reach for low-level tools only when the high-level ones can't express what you need.
+
+Order of preference:
+
+1. **Named-element helpers**: `click_button("Sign up")`, `click_link("Settings")`, `find_button(...)`, `have_button(...)`, `fill_in("Email", with: ...)`.
+2. **Role-scoped Capybara finders**: `find(:button, "...")`, `within(:section, "Account") { ... }`.
+3. **ARIA / data attributes** when there is no visible text: `find('[aria-label="..."]')`, `find('[data-test-id="..."]')`.
+4. **CSS selectors** as a last resort.
+5. **`page.execute_script`** only when the browser fundamentally cannot otherwise do what the test needs (synthesizing custom events, scrolling for IntersectionObserver, etc.).
+
+If a button has no visible text (icon-only, etc.), add an `aria-label` to the component rather than scraping a selector in the test.
+
+### Good
+
+```ruby
+click_button("Sign up")
+expect(find_button("Save")["aria-pressed"]).to eq "true"
+expect(page).to have_link("Settings")
+```
+
+### Bad
+
+```ruby
+find('[data-action="click->form#submit"]').click
+expect(page).to have_css('button[aria-pressed="true"]')
+page.execute_script("document.querySelector('.signup-btn').click()")
+```
+
+## Component system specs must assert accessibility
+
+A component system spec (`spec/components/**/component_system_spec.rb`) exists to verify a component renders and behaves correctly in a real browser — and "correctly" includes being accessible. **Every component system spec must call `expect(page).to be_axe_clean.skipping(SKIPPABLE_AXE_RULES)` at least once**, after the component has rendered (and after any state change that swaps in new markup — an opened menu, an added row, a new field). The axe audit catches missing accessible names, bad ARIA, and broken label associations that no CSS-selector assertion would.
+
+Treat an axe failure as a real bug in the component, not noise to silence: fix the markup (add the `aria-label`, associate the `<label>`, correct the `role`) rather than narrowing the audit — `SKIPPABLE_AXE_RULES` (defined in `spec/rails_helper.rb`) already skips the rules that don't apply to an isolated component preview, so a remaining violation is almost always genuine. Don't add new rules to that skip list to silence a real finding.
+
+```ruby
+visit "/lookbook/preview/ui/dropdown/variants"
+expect(page).to have_css('[aria-expanded="false"]') # settles on the rendered, controller-connected component
+
+click_button("Menu")
+
+expect(page).to have_css('[aria-expanded="true"]')
+expect(page).to be_axe_clean.skipping(SKIPPABLE_AXE_RULES) # audit the open menu — new markup that wasn't there at load
+```
+
+## ActionCable broadcasts: not wired up here (yet)
+
+`config/cable.yml`'s test adapter is `test` (Rails' `ActionCable::TestAdapter`), not `:async` — it only supports assertion helpers like `assert_broadcast_on`, it does **not** round-trip real messages to a live Capybara browser session. This project doesn't broadcast over the cable yet, either — no `broadcasts_to`/`broadcast_*` calls, no channels beyond the generated `app/channels/application_cable/`.
+
+If you add real-time UI updates (a Turbo Stream broadcast that should update an open browser session in a system spec), switch the test adapter to `:async` first — otherwise the broadcast never reaches the page and no assertion will observe it. Once that's done, **don't synthesize `turbo:morph-element` events with `execute_script` to fake the refresh** — call the real broadcaster (`broadcast_replace_to`, `broadcast_refresh_later_to`, etc.) and let Capybara's `wait:` do the synchronization: prepare the data the broadcast will render → call the real broadcaster → assert on an unambiguous post-morph element with a `wait:` (e.g. `expect(page).to have_css(some_new_selector, wait: 5)`). The trailing wait is the synchronization barrier — the test proceeds only once the morph has actually rendered.
+
+## Build Tailwind before running system specs
+
+CI builds `app/assets/builds/tailwind.css` automatically; your local sandbox does not. Without it, Tailwind utility classes (most importantly `hidden` → `display: none`) silently don't apply, and assertions like `expect(tooltip).not_to be_visible` fail in confusing ways that look like flakes but aren't.
+
+**Before running any `:js, type: :system` spec locally, run `bin/rails tailwindcss:build`** (or have `bin/dev` running, which watches and rebuilds). If a system spec is failing on visibility/styling assertions, check `app/assets/builds/tailwind.css` exists and is recent before assuming the test or component is broken.
+
+See the [`frontend-conventions`](../frontend-conventions/SKILL.md) skill for the rest of the styling rules.
+
+## Other conventions
+
+- Always include `:js, type: :system`.
+- Define a few small DSL-style helpers in the file (`def fill_signup_form(...)`, `def open_dropdown_menu`) when they make assertions readable. Don't reach for `page.execute_script` to replace what a helper method could do in Ruby.
diff --git a/.claude/skills/merge-conflicts/SKILL.md b/.claude/skills/merge-conflicts/SKILL.md
new file mode 100644
index 00000000..4096a8ec
--- /dev/null
+++ b/.claude/skills/merge-conflicts/SKILL.md
@@ -0,0 +1,42 @@
+---
+name: merge-conflicts
+description: >-
+  How to bring a branch up to date and resolve git merge conflicts the way this
+  repo expects — merge (never rebase or force-push), understand each side's
+  intent before choosing, ask when a resolution isn't clear-cut, and keep the
+  merge commit to just the merge. Trigger whenever you're about to run
+  `git merge`/`git pull`, sync a branch with `main`, "update from main", or
+  resolve conflict markers left by a merge, cherry-pick, or interrupted pull —
+  including bare phrasings like "fix the conflicts", "merge main in", or "this
+  branch is behind". Not for merging data/files (PDFs, CSVs) or algorithms
+  (merge sort) — this is strictly about git branch integration.
+allowed-tools: Bash, Read, Glob, Grep
+---
+
+# Resolving merge conflicts
+
+This repo's target base is `origin/main`. When a branch needs to catch up with the base, or a merge/cherry-pick/pull leaves conflict markers, follow this — the goal is a clean, honest integration that a reviewer can trust and that never rewrites shared history.
+
+## Bring a branch up to date
+
+- `git fetch origin`, then `git merge --no-edit origin/main`.
+- **Merge, never rebase.** Rebasing rewrites the branch's history; if the branch is already pushed, republishing it needs a force-push, and we never force-push. A merge commit keeps the real history and is always safe to push on top of.
+- If uncommitted work blocks the merge, commit that work first (it belongs to the branch anyway), then merge.
+- Already up to date → nothing to do.
+
+## Keep the merge commit to *just* the merge
+
+A merge commit should contain **only** the reconciliation of the two histories — nothing else. Don't fold in lint fixes, refactors, renames, or "while I'm here" cleanups. Those are real changes a reviewer needs to see on their own; buried inside a merge they're invisible in most diff views and impossible to revert independently. Land them as separate commits *after* the merge.
+
+## Resolving conflicts
+
+When git leaves `<<<<<<<` / `=======` / `>>>>>>>` markers:
+
+- **Understand each side before choosing.** The version on `main` and the version on the branch each exist for a reason. Read enough of both to know what each is trying to do — don't mechanically keep "ours" or "theirs." The correct resolution is often a combination, not one side wholesale.
+- **Consider the branch's purpose.** What is this branch trying to accomplish? A conflict resolution that quietly drops the branch's intent (or reverts something `main` deliberately changed) is a bug, even if it compiles.
+- **Ask when it isn't clear-cut.** If you can't confidently tell which side should win, or the two changes are semantically entangled, stop and ask the user rather than guessing. A wrong silent resolution is worse than a question.
+- After resolving, verify the result actually makes sense — the merged code should reflect both intents, not just parse. Run the relevant tests if the conflict touched logic.
+
+## Never force-push
+
+No exceptions, even on a personal branch. If history has already diverged from the remote and you're tempted to force-push, stop — recover with `git reset --soft <origin-branch>` to get the pushed commits back, then add follow-up work as new commits and push normally.
diff --git a/.claude/skills/pr/SKILL.md b/.claude/skills/pr/SKILL.md
new file mode 100644
index 00000000..fd59f4e5
--- /dev/null
+++ b/.claude/skills/pr/SKILL.md
@@ -0,0 +1,91 @@
+---
+name: pr
+description: >-
+  Create or update a pull request for the current branch. Trigger when the user
+  asks to create/open/make a PR, or to edit/update/rewrite/fix the PR
+  description, body, summary, or title — including bare update phrasings like
+  "update pr", "update this pr", or "update the PR" with no other object — for
+  both new PRs (`gh pr create`) and existing ones (`gh pr edit`). For frontend
+  diffs, delegates the screenshot phase to `references/screenshots.md`, which
+  captures desktop+mobile shots and posts them as a `## Screenshots` PR comment.
+  Use for any verb that lands on a PR's text content: "open a PR", "make a PR",
+  "update pr", "update this pr", "update the PR description", "rewrite the PR
+  body", "fix the description".
+allowed-tools: Bash, Read, Edit, Glob, Grep, Skill
+---
+
+# Pull request workflow
+
+Create or update a pull request for the current branch. If the diff contains frontend changes, delegate the screenshot phase to `references/screenshots.md`, which posts them as a `## Screenshots` PR comment.
+
+The workflow below (steps 0–3) always runs and creates or updates the PR. When the diff is frontend, a second phase captures before/after screenshots and posts them as a PR comment — that machinery lives in `references/screenshots.md`, read only when step 3 sends you there.
+
+## Workflow
+
+### 0. Simplify, lint, and conform to agents.md
+
+Invoke the `/simplify` command to review the changed code for reuse, simplification, and efficiency cleanups and apply them. Do this first, before writing the PR up, so the body describes the diff's final shape rather than a first draft. It's quality-only — it won't touch correctness — so it's safe to run unattended here; if it reports nothing to clean up, move on.
+
+Then run `bin/lint` to auto-format the code (it also picks up whatever `/simplify` just changed). Always use `bin/lint`, never another formatter or `standardrb` directly.
+
+Then review the changed files against the repo's `agents.md` and fix anything that doesn't conform — code-style guidelines (functional style, no argument mutation, omitted hash values like `{x:}`, private methods, unabbreviated names, pithy comments), testing conventions, and frontend rules. Only touch lines this branch already changed; don't reformat unrelated code.
+
+Commit these edits before continuing — step 1's `git merge` needs a clean working tree, and committing here is what lets the step 0 edits ride along the merge as ordinary branch commits (which step 3 then pushes). A message like `Tidy comments and lint` is fine; end it with the standard `Co-Authored-By` trailer. Never amend or force-push pushed history — see global preferences.
+
+### 0.5. Determine the base branch
+
+The base is the branch this PR goes off of — `main` by default, or a specific branch when the user names one to target. The head is always the current branch (`HEAD`), so the branch that determines the base is a *different* one the user points at: "a PR off of `release-2`", "base this on `release-2`", "onto/target `release-2`", "stacked on `<branch>`", or a `--base <branch>` argument all set the base to that branch. Naming the branch you're already on just identifies the head — the base stays `main`. If it's genuinely unclear whether a named branch is meant as the base, ask rather than guess. Set `BASE` accordingly (default `main`) and use it everywhere below: step 1 refers to `origin/$BASE`, and step 3 passes `gh pr create --base "$BASE"`. Never silently retarget an explicitly-named base to `main`.
+
+When updating an **existing** PR, leave its base untouched — run `gh pr edit` without `--base` (which preserves the current base). Only retarget an existing PR's base when the user explicitly asks.
+
+### 1. Update from the base, then gather branch state
+
+First bring the branch up to date with the base (`$BASE` from step 0.5) so the PR reflects the current base and merges without surprises. Follow the `merge-conflicts` skill: `git fetch origin` then `git merge --no-edit "origin/$BASE"`, merge (never rebase), keep the merge commit to just the merge (the step 0 edits ride along as ordinary commits), and resolve any conflicts per that skill.
+
+Then gather state — run in parallel:
+- `git status` (no `-uall`)
+- `git diff "origin/$BASE"...HEAD --stat`
+- `git diff "origin/$BASE"...HEAD --name-only`
+- `git log "origin/$BASE"..HEAD --oneline`
+- `EXISTING_PR=$(gh pr view --json number,url,title 2>/dev/null)` — capture for step 3. When non-empty, parse the PR number with `PR_NUMBER=$(echo "$EXISTING_PR" | jq -r .number)`; step 3 and the screenshot phase reuse it.
+
+Diff against `origin/$BASE`, not the local base branch — in a Conductor worktree the local base often lags the remote, which would inflate or stale the diff (the `git fetch` above refreshes `origin/$BASE`). If the branch has no commits ahead of `origin/$BASE`, stop and tell the user.
+
+No `bin/env` eval is needed here — it's only relevant to the screenshot phase, and `frontend-screenshots` runs its own in preflight. Backend-only PRs never touch it.
+
+### 2. Classify the diff
+
+A change is "frontend" if any changed path matches:
+- `app/views/**` (`.erb`, `.html.erb`)
+- `app/components/**` (ViewComponent templates or Ruby)
+- `app/javascript/**`
+- `app/assets/**`
+- `config/tailwind*`, `tailwind.config.*`, `postcss.config.*`
+- `*.scss`, `*.css`, `*.coffee`, `*.js`, `*.ts`
+
+Record this as `FRONTEND=true|false` for the screenshot decision at the end of step 3.
+
+### 3. Build the summary body and create/update the PR
+
+Write a summary of the change (2–5 bullets based on the diff and recent commits) to a temp file. Follow the repo's existing PR body style — look at the last few merged PRs (`gh pr list --state merged --limit 5 --json body,title`) to match tone and length. Keep the title under ~70 chars.
+
+Bias hard toward brevity — default to a one-line intro plus ~2-3 bullets, not the 5-bullet maximum. Reviewers skim. A bullet that fits on one line beats one that wraps three times — push detail down to the diff or commit log, not the body. If a per-file bullet starts feeling like an essay, compress to a single sentence naming the *kind* of change (e.g., "tightened description, trimmed unused allowed-tools, consolidated duplicated snippets") rather than enumerating each edit.
+
+Cut anything the reviewer can see in the diff. Implementation mechanics — which HTTP client, file-mode flags, helper-method names, column renames, the exact tasks/files removed — belong to the diff, not the body. Keep only what the diff *doesn't* make obvious: what the PR adds, the single entry point a reviewer would use, and any non-obvious behavior or decision they'd otherwise have to reverse-engineer. When in doubt, leave it out and let the code speak. Aim for under ~6 bullets total including nested ones; if you're past that, regroup by category — but most PRs should land well under that.
+
+Describe the end state, not the journey. Reviewers want to know what the PR does *now* — the diff that will land — not the order in which it was built. Avoid framings like "first pass" / "second pass", commit-hash references for stages of work that all merge into the same shipped diff, "originally we tried X then switched to Y", or play-by-play of how the conversation evolved. The git log preserves that. If a discarded approach is genuinely load-bearing context for the reviewer (e.g., explains why the chosen approach is structured oddly), one line is enough; otherwise omit. The same applies when *updating* an existing PR body: rewrite to describe the current diff, don't append a changelog of edits made since the last revision.
+
+**No "Test plan" section unless the user asks.** Don't list things CI already covers — `bundle exec rspec ...`, `bin/lint`, `bin/dev` boots cleanly, etc. Those belong to CI, not the PR body. Only add a Test plan when there's reviewer-facing manual verification a human needs to do (e.g. "click X, confirm Y appears"), and only when the user requests it.
+
+**No generic "covered by tests" bullet.** Drop summary bullets like "Covered by specs and a fixture" / "Added tests" / "Includes specs" — that a change is tested is assumed, so the bullet adds no information, and it names test *mechanics* (a fixture, a VCR cassette, an inline `StringIO`) that quietly go stale when the test approach changes mid-PR. Mention tests in the body only when *what* is verified is itself the reviewer-facing point (e.g. "adds a regression test for the UTF-8 download crash"), not merely that tests exist.
+
+**No Claude Code attribution footer.** Don't append the "🤖 Generated with [Claude Code](https://claude.com/claude-code)" line (or any variant of it) to the body. The PR body should read like the human author wrote it.
+
+Push the branch: `git push -u origin HEAD`.
+
+- If `$EXISTING_PR` from step 1 was non-empty: `gh pr edit "$PR_NUMBER" --title "..." --body-file <tmp-body-file>` (`$PR_NUMBER` was parsed in step 1). Refresh the title to match the current diff (this is what an "update pr" request expects) unless the user already gave the PR a deliberate custom title you'd be clobbering — if unsure, keep the existing title and only update the body.
+- Otherwise: `gh pr create --draft --base "$BASE" --title "..." --body-file <tmp-body-file>` (`$BASE` from step 0.5). Create as a draft by default; only omit `--draft` (or mark ready) if the user explicitly asks for a ready-for-review PR. Capture the new PR number into `PR_NUMBER` from the output for the screenshot phase.
+
+Always pass the body via `--body-file` (not inline `--body`) to preserve formatting.
+
+**If `FRONTEND=false`, stop here and return the PR URL.** If `FRONTEND=true`, read `references/screenshots.md` and follow it to capture before/after screenshots and post them as a PR comment (it uses `$EXISTING_PR`/`$PR_NUMBER` from the steps above). Screenshot tooling never blocks the PR — if it fails, return the PR URL and report the failure.
diff --git a/.claude/skills/pr/references/screenshots.md b/.claude/skills/pr/references/screenshots.md
new file mode 100644
index 00000000..175d3e8d
--- /dev/null
+++ b/.claude/skills/pr/references/screenshots.md
@@ -0,0 +1,96 @@
+# Screenshot phase
+
+Read this after the PR exists (SKILL.md steps 0–3) when the diff is frontend and screenshots are warranted. It carries over `FRONTEND`, `$EXISTING_PR`, and `$PR_NUMBER` from those steps.
+
+The flow: decide what to capture → capture the branch → upload → capture the same URLs on the base branch → post one `## Screenshots` PR comment. Screenshots go in a **comment**, never the PR body, so the human-written summary stays first and recaptures don't churn the description.
+
+## 1. Decide whether screenshots are needed and which URLs to capture
+
+You're only here because `FRONTEND=true` (SKILL.md gates on that before sending you here). Decide scope by PR state:
+
+- New PR → capture every affected page.
+- Existing PR → continue only if the captures in the existing screenshots comment are stale: a commit since the last capture touched a page already screenshotted, or a new affected page now appears in the diff. Limit the capture to those pages. If nothing has moved, return the PR URL.
+
+From the changed files, infer the affected routes. Heuristics:
+- A view at `app/views/u/show.html.erb` → `/u/:username` (pick a representative user from the dev db, e.g. `User.last.username_slug`)
+- A component touched by a specific page → screenshot that page
+- A shared component (navbar, UI::Badge, etc.) → screenshot 1–2 representative pages that exercise it
+- A component with a Lookbook preview → its preview URL `/lookbook/preview/<component>/<scenario>` — a real responsive page, captured like any other URL
+- Admin views → `/admin/...`
+- If unclear, ask the user which URLs to capture before proceeding. Do not guess blindly — 1–3 well-chosen URLs beats 10 random ones.
+
+## 2. Capture branch screenshots
+
+Invoke the `frontend-screenshots` skill with the `(url-path, page-slug)` pairs from step 1. It handles the dev-server check, signing in (asking the user for credentials when needed — convus_webapp has no seeded users), a PII safety check, viewport sizing, and per-PNG sanity checks. It returns local paths under `tmp/pr_screenshots/<branch>-<page>-<timestamp>-{desktop,mobile}.png`.
+
+If `frontend-screenshots` returns failures it couldn't diagnose, surface them and stop — don't post partial screenshots.
+
+## 3. Upload branch screenshots and get inline URLs
+
+Invoke the `github-upload-image-to-pr` skill **for uploading only**: run it through its step 7 (upload each PNG from step 2, read back the `user-attachments/assets/` URLs, clear the textarea) and **stop there — do not run its step 8 posting.** This phase composes and posts one combined before/after comment itself in step 5, so the upload skill must not post its own. GitHub mints persistent URLs that render inline in the browser (release assets would force a download on click).
+
+Collect the returned URLs, keyed by `(page-slug, viewport)`.
+
+## 4. Capture and upload the same URLs on the base branch
+
+Capture the **base-branch** (`$BASE` from SKILL.md step 0.5) version of every screenshot from step 2 so the section becomes a before/after comparison instead of "here's how it looks now." This is the default for every screenshot captured — if you got this far, the diff is frontend, and the comparison is informative (a same-screenshot pair documents visual parity for a refactor; a different pair documents the actual visual change).
+
+Skip per-page only when the URL didn't exist on `$BASE` (a brand-new route or page added in this PR) — there's nothing to compare to.
+
+Re-invoke `frontend-screenshots` with the same `(url-path, page-slug)` pairs and tell it to capture against the base (its "Cross-branch comparison" section — checks out the base ref, captures into `...-main-...` filenames, returns to the original branch). Then re-invoke `github-upload-image-to-pr` for those PNGs (upload-only, exactly as in step 3 — collect URLs, do not post).
+
+Caveat when `$BASE` isn't `main`: `frontend-screenshots` currently hardcodes `origin/main` for that capture, so it can't shoot a non-`main` base yet. Until it's parameterized, capture branch-only for a non-`main` base and say so in the comment rather than posting a mislabeled comparison.
+
+## 5. Post the Screenshots section as a PR comment
+
+On a fresh PR, this comment is naturally the first one. On an update, find the existing screenshots comment (the one authored by you whose body starts with `## Screenshots`) and edit it in place rather than posting a new one:
+
+```bash
+SCREENSHOT_COMMENT_ID=$(gh api "repos/{owner}/{repo}/issues/$PR_NUMBER/comments" \
+  --jq '.[] | select(.body | startswith("## Screenshots")) | .id' | head -1)
+```
+
+`{owner}` and `{repo}` are expanded by `gh api`, but `PR_NUMBER` is not — pass it as the shell variable `$PR_NUMBER` (parsed in SKILL.md step 1 / captured from step 3's create output), not a literal `{PR_NUMBER}`.
+
+- If `$SCREENSHOT_COMMENT_ID` is empty: `gh pr comment "$PR_NUMBER" --body-file <tmp-comment-file>`.
+- Otherwise: `gh api -X PATCH repos/{owner}/{repo}/issues/comments/$SCREENSHOT_COMMENT_ID -f body="$(cat <tmp-comment-file>)" --jq .html_url`. Don't use `-f body=@<file>` — `gh api`'s `-f` stores the literal string `@<file>` rather than reading it, so the comment gets clobbered with the filename. Re-verify after editing: `gh api repos/{owner}/{repo}/issues/comments/$SCREENSHOT_COMMENT_ID --jq .body | head`.
+
+**Headers are always `| Desktop | Mobile |`** — that stays the same regardless of whether there's a base-branch comparison. The base-branch shots and branch shots stack as additional rows, with a small indicator row between them when both are present.
+
+Default (with base-branch comparison — put the actual base name from `$BASE`, e.g. `main`, in the indicator row):
+
+```markdown
+## Screenshots
+
+### <url-path>
+
+| Desktop | Mobile |
+| --- | --- |
+| <img src="<base-desktop-url>" width="500"> | <img src="<base-mobile-url>" width="250"> |
+| $BASE 👆 | this branch 👇 |
+| <img src="<branch-desktop-url>" width="500"> | <img src="<branch-mobile-url>" width="250"> |
+```
+
+Brand-new page (URL didn't exist on `$BASE` — see step 4), no comparison row:
+
+```markdown
+### <url-path>
+
+| Desktop | Mobile |
+| --- | --- |
+| <img src="<branch-desktop-url>" width="500"> | <img src="<branch-mobile-url>" width="250"> |
+```
+
+Rules:
+- Each page gets a `### <url-path>` subheading (the literal path, e.g. `/`, `/u/someuser`, `/admin/ratings`) followed by its own table.
+- **Every** entry uses this table, with **no exceptions** — including `/lookbook/preview/...` component previews. A preview is a responsive page with a real URL, so it gets the same desktop+mobile before/after cells as any page. A width-invariant component (small icon, fixed-size control) just yields matching desktop and mobile shots — that's expected; keep both columns, never collapse to one image or special-case previews.
+- **Headers are always `| Desktop | Mobile |`** — never `| main | this branch |` or any per-PR variation. Reviewers should see the same column meaning across every PR.
+- Use `<img src=... width=...>` rather than `![]()` so the widths render predictably in GitHub's table cells. ~500 for desktop, ~250 for mobile fits a side-by-side cell layout cleanly.
+
+When updating an existing screenshots comment, replace the existing `### <url-path>` block for any page you recaptured; leave other pages' blocks alone.
+
+Return the PR URL.
+
+## If the tooling fails
+
+If `frontend-screenshots` or `github-upload-image-to-pr` fails, report the failure clearly and leave the PR without screenshots — don't block PR creation on screenshot tooling.
diff --git a/.claude/skills/rspec-testing/SKILL.md b/.claude/skills/rspec-testing/SKILL.md
new file mode 100644
index 00000000..c1e943da
--- /dev/null
+++ b/.claude/skills/rspec-testing/SKILL.md
@@ -0,0 +1,197 @@
+---
+name: rspec-testing
+description: >-
+  RSpec testing conventions for this project — how to structure specs with
+  `context` and `let`, what kinds of tests to write, and what to avoid
+  (mocks, controller specs, testing private methods). Trigger when writing
+  or modifying any `*_spec.rb` file, adding test coverage for new code,
+  refactoring tests, or designing the test layout for a new feature.
+  Includes Good/Bad examples of the project's preferred style.
+---
+
+# RSpec testing
+
+This project uses RSpec. All business logic should be tested.
+
+## What to test (and what not to)
+
+- Tests should either: help make the code correct now, or prevent bugs in the future. Don't add tests that don't do one of those things.
+- Use **request specs**, not controller specs — request specs go through the full middleware/routing stack, so they catch breakage controller specs can't see. Everything making the same request should be in a single test.
+- Avoid testing private methods.
+- Avoid mocking objects.
+  - If making external requests, use VCR. Never hand-write or hand-edit cassettes (not even a single value or a stale `Content-Length`) — when a cassette is missing or its upstream data changed, delete it and re-record by running the tests.
+  - Cassettes that get modified when you run specs locally are re-recordings, not unrelated churn — they're supposed to update. Commit them with your branch; don't revert them to "keep the PR focused".
+- Don't use `tap` to bundle factory creation with follow-up setup. Create the record in `let`/`let!`, then do the follow-up work on its own line (a separate statement, or a `before` block) — one thing per line reads better and keeps the factory call clean.
+
+### Good
+
+```ruby
+let!(:user) { FactoryBot.create(:user) }
+before { user.update!(account_private: true) }
+```
+
+### Bad
+
+```ruby
+let!(:user) do
+  FactoryBot.create(:user).tap do |user|
+    user.update!(account_private: true)
+  end
+end
+```
+
+## Stubbing ENV
+
+Never partial-mock `ENV` with `allow(ENV).to receive(:[]).and_call_original` — it makes every subsequent `ENV[...]` lookup go through RSpec's message router, which is slow and easy to break by forgetting a `.with(...)` branch.
+
+Use `stub_const` against a merged hash instead:
+
+### Good
+
+```ruby
+stub_const("ENV", ENV.to_hash.merge("STRIPE_SECRET_KEY" => "sk_test_123"))
+```
+
+### Bad
+
+```ruby
+allow(ENV).to receive(:[]).and_call_original
+allow(ENV).to receive(:[]).with("STRIPE_SECRET_KEY").and_return("sk_test_123")
+```
+
+## Drain Sidekiq jobs, don't run them inline
+
+Run enqueued jobs by draining them in the default fake mode — `SomeJob.drain` for one job, `Sidekiq::Worker.drain_all` for everything (clear first with `Sidekiq::Worker.clear_all` when earlier setup left jobs queued — see `spec/rails_helper.rb`'s global `config.before { Sidekiq::Worker.clear_all }`). Don't wrap the exercise in `Sidekiq::Testing.inline!`. Draining lets the request finish and commit before the jobs run, against that committed state — the way production does it — and keeps the test from silently pulling in every cascading job.
+
+## Always fix failing tests
+
+Fix every failing test, even ones that were already failing on `main`. Confirming a failure pre-dates your branch (via `git stash` or checking out `main`) explains *what* broke — not whether you fix it. You fix it.
+
+## Don't weaken assertions to make a failing test pass
+
+When a test goes red, the correct move is **investigate why**, not edit the assertion to match the new output. Watch for these tempting "fixes" that are actually erasing signal:
+
+- Changing an expected value to whatever the page/chart/response now happens to render (e.g. `0` → `null`, an exact count → a range, a specific string → a substring/regex).
+- Loosening `eq` to `include`, dropping `count:` constraints, or replacing `expect(...).to ...` with `expect(...).not_to be_nil`.
+- Deleting the assertion entirely with a "looks unrelated" handwave.
+
+The right loop: reproduce the failure, figure out *what* changed and *why*, then decide intentionally — fix the code if the original assertion captured the right behavior, or update the assertion (with a comment) if the behavior intentionally changed. If you're about to change a test "to make it easier", stop and explain why the new expectation is correct, not just convenient.
+
+## Match a target attributes hash, not one attribute at a time
+
+When you're checking several fields on the same object or response, build one expected-attributes hash and assert against it in a single matcher. Don't write a chain of one-attribute-per-line `expect`s.
+
+- Object (ActiveRecord, plain Ruby): `expect(record).to have_attributes(target_attributes)`
+- Hash (JSON response, parsed body): `expect(hash).to eq(target.as_json)` for full match, or `expect(hash).to include(target_attributes)` for partial.
+
+This collapses what would be 4 brittle assertions into 1, makes the *contract* visible at a glance, and gives a single readable diff when something changes. It also avoids the trap of weak per-field assertions like `expect(x).to be_present` or `expect(url).not_to include("blank.png")` standing in for "the right value" — match the value directly.
+
+### Good
+
+```ruby
+target_attributes = {username: "testuser", email: "test@example.com"}
+expect(user).to have_attributes(target_attributes)
+
+expect(json_result["citations"]).to eq([target_citation.as_json])
+```
+
+### Bad
+
+```ruby
+expect(user.username).to eq("testuser")
+expect(user.email).to be_present
+expect(user.email).to eq("test@example.com")
+
+display_name = json_result["citations"].first["display_name"]
+expect(display_name).to be_present
+expect(display_name).not_to eq(target_citation.pretty_url)
+expect(display_name).to eq(target_citation.display_name)
+```
+
+The bad version spreads one logical assertion across many lines, mixes weak presence checks with the real expected value, and produces noisier failure output.
+
+## Structuring with `context` and `let`
+
+Use `context` and `let` to isolate what varies between examples. Each `it` block should live in a `context` that names the condition, with `let` overrides for only what differs in that case. **Avoid repeating setup across sibling `it` blocks.**
+
+### Good
+
+```ruby
+describe "display_name" do
+  let(:citation) { Citation.new(url: "https://example.com/article", title:) }
+  let(:title) { nil }
+
+  it "returns the pretty_url when title is blank" do
+    expect(citation.display_name).to eq citation.pretty_url
+  end
+
+  context "when title is present" do
+    let(:title) { "Example Article" }
+
+    it "returns title" do
+      expect(citation.display_name).to eq "Example Article"
+    end
+  end
+end
+```
+
+### Bad
+
+```ruby
+it "returns display_name" do
+  citation = FactoryBot.create(:citation, title: "Example Article")
+  expect(citation.display_name).to eq "Example Article"
+end
+it "returns pretty_url when title is blank" do
+  citation = FactoryBot.create(:citation)
+  allow(citation).to receive(:title) { nil }
+  expect(citation.display_name).to eq citation.pretty_url
+end
+```
+
+The bad version repeats setup, mocks the object, and doesn't communicate what each case represents.
+
+## One example per distinct setup — combine same-setup `it` blocks
+
+`context`/`let`/`before` isolate what *varies*. The corollary runs the other way: if two sibling `it` blocks share the **same** setup — no differing `context`, `before`, or `let` override between them — collapse them into **one** example. Each distinct setup earns exactly one `it`; put all of that setup's assertions (and all of its requests/renders) in that single block.
+
+This is the same instinct as "everything making the same request should be in a single test", generalized: splitting same-setup assertions across sibling `it` blocks re-runs identical setup (factories, HTTP requests, renders) once per block for zero isolation benefit, and scatters one logical behavior across the file. Two `it` blocks that differ *only* in the request params or the assertion — with identical `let`s and no `before` between them — are one example.
+
+After writing a spec, scan each `context`/`describe`: if it holds multiple `it` blocks and they don't each sit behind a distinct `context`/`before`/`let`, merge them.
+
+### Good
+
+```ruby
+context "signed-in user" do
+  let(:current_user) { FactoryBot.create(:user) }
+  before { sign_in current_user }
+
+  it "shows the edit form and updates the username" do
+    get edit_u_path(current_user.to_param)
+    expect(response.body).to match("Edit account")
+
+    patch u_path(current_user.to_param), params: {user: {username: "new-username"}}
+    expect(current_user.reload.username).to eq "new-username"
+  end
+end
+```
+
+### Bad
+
+```ruby
+context "signed-in user" do
+  let(:current_user) { FactoryBot.create(:user) }   # re-created for every it below
+  before { sign_in current_user }
+
+  it "shows the edit form" do
+    get edit_u_path(current_user.to_param)
+    expect(response.body).to match("Edit account")
+  end
+  it "updates the username" do
+    patch u_path(current_user.to_param), params: {user: {username: "new-username"}}
+    expect(current_user.reload.username).to eq "new-username"
+  end
+end
+```
+
+This only merges blocks whose setup is identical. Different setup still means separate examples, each in its own `context` with the `let`/`before` that differs — that's the section above, not a contradiction of it.
diff --git a/.claude/skills/sandbox-test-setup/SKILL.md b/.claude/skills/sandbox-test-setup/SKILL.md
new file mode 100644
index 00000000..071d5b0d
--- /dev/null
+++ b/.claude/skills/sandbox-test-setup/SKILL.md
@@ -0,0 +1,324 @@
+---
+name: sandbox-test-setup
+description: >-
+  Ruby + RSpec environment setup for convus_webapp. Two environments:
+  **(A) local macOS Conductor workspace** (`/Users/…/conductor/workspaces/…`) —
+  Ruby 4.0.6 is installed via mise but Claude Code's shell sometimes
+  spawns subprocesses without the mise shim, so bare `ruby`/`bundle`
+  falls back to system 2.6 and fails. Fix is a PATH prefix, not a
+  reinstall. **(B) Claude Code's Linux web sandbox** —
+  Ruby 4.0.6 must be built from source (~8–10 min, `cache.ruby-lang.org`
+  firewalled); also postgres/redis, tailwind build, Chrome-matching
+  ChromeDriver, and a local jsdelivr proxy for `:js, type: :system`
+  specs. Trigger whenever a session runs RSpec/bundle/`bin/lint`, or
+  the user reports `Bundler::RubyVersionMismatch` /
+  `command not found: rspec` / `tailwind.css is not present` /
+  chromedriver version-mismatch.
+---
+
+# Running Ruby + RSpec
+
+**The Ruby patch version (`4.0.6`) is hardcoded throughout this skill** — in
+PATH prefixes, `/opt/ruby-*` build paths, and the source-tarball URL. It
+mirrors `.tool-versions` / `Gemfile`; when those bump, re-grep this file and
+update every occurrence, or the build recipe will silently target the wrong
+version.
+
+Pick the section matching the environment: macOS paths under
+`/Users/…/conductor/workspaces/…` use **Local macOS**; Linux paths
+under `/home/user/…` use **Claude Code web sandbox**.
+
+## Local macOS (Conductor workspace)
+
+Ruby 4.0.6 is installed via [mise](https://mise.jdx.dev/), but Claude
+Code's shell sometimes spawns subprocesses without the mise shim on
+PATH — bare `ruby` then resolves to `/usr/bin/ruby` (2.6) and `bundle`
+fails. **The Ruby is installed; the PATH just isn't right** — don't
+reinstall, don't edit the Gemfile.
+
+Check first; only prefix PATH if `ruby -v` doesn't already print 4.0.6
+(`mise exec -- ruby`/`bundle` are unreliable in this harness — they
+can still resolve to system 2.6, so use the direct prefix):
+
+```bash
+ruby -v
+# If it's not 4.0.6:
+export PATH="/Users/seth/.local/share/mise/installs/ruby/4.0.6/bin:$PATH"
+```
+
+Then run specs the normal way:
+
+```bash
+bundle exec rspec spec/path/to/file_spec.rb
+```
+
+(No need to `eval "$(ruby bin/env --export)"` first — `config/boot.rb` loads
+`bin/env` for every Ruby entry point, so `WORKSPACE_ID` / `DEV_PORT` /
+`BASE_URL` / `REDIS_URL` are already set inside the process. Only export
+them into the shell when the shell itself reads them, e.g.
+`curl "$BASE_URL/..."`.)
+
+If this checkout has a `.workspace_id`, its databases are suffixed with that
+ID (`convus_reviews_test_<id>`). A workspace that has never run
+`bin/workspace_setup` has no `.workspace_id` and falls back to the
+un-suffixed `convus_reviews_test`, **shared with the root checkout** — if
+specs here are clobbering another checkout's data, that's why. Run
+`bin/workspace_setup` to get an isolated database.
+
+If `rails_helper` aborts complaining about a pending migration, run
+`bundle exec rails db:create db:migrate` first
+(`ActiveRecord::Migration.maintain_test_schema!`).
+
+Lint with `bin/lint` (same PATH prefix if needed). Postgres, redis,
+and CDN access are handled by your local dev environment —
+skip the rest of this skill **except** Tailwind build below, which
+can still bite a fresh Conductor workspace where `bin/dev` hasn't
+run.
+
+## Claude Code web sandbox
+
+The Gemfile pins `ruby "4.0.6"`. No prebuilt 4.0.6 binary is reachable
+(`cache.ruby-lang.org` is 403'd, `ruby/ruby-builder`'s toolcache tops
+out at `3.5.0-preview1`), so build from the GitHub source tag — about
+8–10 min on a 4-core sandbox. Don't fall back to 3.x and patch the
+Gemfile; Bundler 4.x's resolver behaves differently and you'll waste
+time chasing fake regressions. Once `/opt/ruby-4.0.6/x64/` exists,
+`bundle install` works as-is.
+
+## One-shot Ruby 4.0.6 build
+
+Skip if `/opt/ruby-4.0.6/x64/bin/ruby --version` already prints 4.0.6.
+Two quirks the bash block handles: (1) GitHub source tarballs lack a
+pre-generated `configure`, so `autogen.sh` runs first; (2) `make install`
+fetches ~30 bundled gems via `BASERUBY`, whose hardcoded CA bundle
+doesn't include the sandbox egress-proxy CA — so we pre-stage every
+bundled gem with `curl` (which honours
+`/etc/ssl/certs/ca-certificates.crt`) before `make install`.
+
+```bash
+# 1. Source — GitHub tag tarball (cache.ruby-lang.org is blocked)
+mkdir -p /tmp/ruby-build-src && cd /tmp/ruby-build-src
+curl -sfL "https://github.com/ruby/ruby/archive/refs/tags/v4.0.6.tar.gz" \
+  | tar -xz
+cd ruby-4.0.6
+
+# 2. Generate ./configure (GitHub source tarballs don't ship it)
+./autogen.sh
+
+# 3. Pre-stage every bundled gem (avoids the rubygems-cert MITM issue)
+while read name ver _; do
+  case "$name" in ''|'#'*) continue ;; esac
+  out="gems/${name}-${ver}.gem"
+  [ -s "$out" ] || curl -sfL --max-time 60 -o "$out" \
+    "https://rubygems.org/downloads/${name}-${ver}.gem"
+done < gems/bundled_gems
+
+# 4. Configure + build + install (BASERUBY = preinstalled /opt/ruby-3.3.6)
+mkdir -p /tmp/ruby-build-src/build && cd /tmp/ruby-build-src/build
+/tmp/ruby-build-src/ruby-4.0.6/configure \
+  --prefix=/opt/ruby-4.0.6/x64 \
+  --enable-shared \
+  --disable-install-doc \
+  --with-openssl-dir=/usr
+make -j"$(nproc)"
+SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt make install
+
+# 5. Match the GitHub-Actions hostedtoolcache layout some shebangs assume
+mkdir -p /opt/hostedtoolcache/Ruby/4.0.6
+[ -e /opt/hostedtoolcache/Ruby/4.0.6/x64 ] || \
+  ln -s /opt/ruby-4.0.6/x64 /opt/hostedtoolcache/Ruby/4.0.6/x64
+
+cd "$REPO_DIR"  # wherever convus_webapp is checked out, e.g. /home/user/convus_webapp
+/opt/ruby-4.0.6/x64/bin/ruby --version   # => ruby 4.0.6 ... [x86_64-linux]
+```
+
+## Toolchain on PATH
+
+The Playwright Chromium directory has a build number that changes
+between sandbox images, so glob it instead of hardcoding. `service`
+lives only on `/usr/sbin`.
+
+```bash
+CHROME_DIR=$(ls -d /opt/pw-browsers/chromium-*/chrome-linux | sort -V | tail -1)
+export PATH="/opt/ruby-4.0.6/x64/bin:$CHROME_DIR:/usr/local/bin:/usr/bin:/bin:/usr/sbin"
+export LD_LIBRARY_PATH="/opt/ruby-4.0.6/x64/lib:$LD_LIBRARY_PATH"
+bundle install
+```
+
+## Services + DB
+
+Start postgres and redis once per session (redis logs a benign ulimit
+warning). Set the `postgres` superuser's password + create the test DB
+once per machine. `CI=1` makes `database.yml` use the postgres/password
+creds at 127.0.0.1. This app is single-database (no analytics DB).
+
+The sandbox is a fresh checkout with no `.workspace_id`, so `WORKSPACE_ID` is
+unset and the database name is the un-suffixed `convus_reviews_test` below.
+Don't run `bin/workspace_setup` here — workspace IDs exist to keep concurrent
+local checkouts apart, which doesn't apply in a throwaway sandbox, and it
+would only add a suffix the commands below don't expect.
+
+```bash
+service postgresql start
+service redis-server start
+
+# Once per machine:
+sudo -u postgres psql -c "ALTER USER postgres PASSWORD 'password';"
+sudo -u postgres psql -c "CREATE DATABASE convus_reviews_test OWNER postgres;"
+
+eval "$(ruby bin/env --export)"
+export RAILS_ENV=test CI=1
+bundle exec rails db:migrate db:test:prepare
+```
+
+## Tailwind build (both environments)
+
+The application layout calls `stylesheet_link_tag 'tailwind'`. Without
+`app/assets/builds/tailwind.css`, specs that render the layout (request
+specs hitting `format: :html`, or any `:js, type: :system` spec) fail
+with `Sprockets::Rails::Helper::AssetNotFound`. This applies to both
+the sandbox AND a fresh Conductor workspace where `bin/dev` /
+`tailwindcss:build` haven't run yet. **Don't write the failure off as
+"pre-existing" — build Tailwind:**
+
+```bash
+bundle exec rails tailwindcss:build
+```
+
+(See the `integration-testing` skill — same rule applies to
+layout-rendering request specs, not just system specs.)
+
+## Running plain specs
+
+After Toolchain + Services + DB above:
+
+```bash
+bundle exec rspec spec/models spec/requests spec/jobs
+```
+
+## Running `:js, type: :system` specs (component system)
+
+Two extra hurdles in the sandbox:
+
+### 1. Chrome + matching ChromeDriver
+
+- Chrome binary lives at `/opt/pw-browsers/chromium-*/chrome-linux/chrome`
+  — the `chromium-NNNN` directory has a Playwright build number that
+  changes between sandbox images, so glob it.
+- `/opt/node22/bin/chromedriver` is too new (it tracks current stable;
+  Chrome here is whatever Playwright bundled). Pull the matching driver
+  from Google's CfT bucket — `storage.googleapis.com` is allowed:
+  ```bash
+  CHROME_DIR=$(ls -d /opt/pw-browsers/chromium-*/chrome-linux | sort -V | tail -1)
+  CHROME_VER=$("$CHROME_DIR/chrome" --version | grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+")
+  curl -sfL "https://storage.googleapis.com/chrome-for-testing-public/${CHROME_VER}/linux64/chromedriver-linux64.zip" \
+    -o /tmp/chromedriver.zip
+  unzip -o -q /tmp/chromedriver.zip -d /tmp
+  cp /tmp/chromedriver-linux64/chromedriver /usr/local/bin/chromedriver
+  ```
+- Capybara's default `:selenium_chrome_headless` doesn't pass
+  `--no-sandbox` or a unique `--user-data-dir`, both required when
+  Chrome runs as root in a container, and it doesn't route
+  `cdn.jsdelivr.net` to the local proxy above. convus_webapp has no
+  `spec/support/local_chrome.rb` for this — create one, gated on
+  `LOCAL_CHROME_OVERRIDE=1` so CI and developer machines are
+  unaffected (everything under `spec/support/**/*.rb` is
+  auto-required by `spec/rails_helper.rb`, so this only needs doing
+  once per checkout):
+  ```bash
+  cat > spec/support/local_chrome.rb <<'RUBY'
+  if ENV["LOCAL_CHROME_OVERRIDE"]
+    Capybara.register_driver :selenium_chrome_headless do |app|
+      options = Selenium::WebDriver::Chrome::Options.new
+      options.add_argument("--headless=new")
+      options.add_argument("--no-sandbox")
+      options.add_argument("--disable-dev-shm-usage")
+      options.add_argument("--disable-site-isolation-trials")
+      options.add_argument("--ignore-certificate-errors")
+      options.add_argument("--host-resolver-rules=MAP cdn.jsdelivr.net 127.0.0.1:8443")
+      options.add_argument("--user-data-dir=/tmp/chrome-test-#{Process.pid}-#{rand(10_000)}")
+      Capybara::Selenium::Driver.new(app, browser: :chrome, options: options)
+    end
+  end
+  RUBY
+  ```
+  Then just set `LOCAL_CHROME_OVERRIDE=1` when running system specs.
+
+### 2. `cdn.jsdelivr.net` is firewalled
+
+`config/importmap.rb` pins three modules from `cdn.jsdelivr.net` (403'd)
+— `@bikeindex/time-localizer`, `@floating-ui/dom`, and `sortablejs`.
+Without them, pages render empty. Fetch from `registry.npmjs.org`
+(allowed) and serve locally over TLS at the same path layout. Versions
+below mirror `config/importmap.rb`; bump when that changes.
+
+```bash
+mkdir -p /tmp/cdn/bikeindex-time-localizer \
+         /tmp/cdn/floating-ui-dom /tmp/cdn/sortablejs
+curl -sL "https://registry.npmjs.org/@bikeindex/time-localizer/-/time-localizer-0.2.0.tgz" \
+  | tar -xz -C /tmp/cdn/bikeindex-time-localizer --strip-components=1
+curl -sL "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.7.3.tgz" \
+  | tar -xz -C /tmp/cdn/floating-ui-dom --strip-components=1
+curl -sL "https://registry.npmjs.org/sortablejs/-/sortablejs-1.15.6.tgz" \
+  | tar -xz -C /tmp/cdn/sortablejs --strip-components=1
+
+# Reproduce the jsdelivr URL layout
+mkdir -p '/tmp/cdn/serve/npm/@bikeindex' \
+         '/tmp/cdn/serve/npm/@floating-ui/dom@1.7.3' \
+         '/tmp/cdn/serve/npm/sortablejs@1.15.6/modular'
+ln -sf /tmp/cdn/bikeindex-time-localizer \
+       '/tmp/cdn/serve/npm/@bikeindex/time-localizer@0.2.0'
+cp /tmp/cdn/floating-ui-dom/dist/floating-ui.dom.mjs \
+   '/tmp/cdn/serve/npm/@floating-ui/dom@1.7.3/+esm'
+cp /tmp/cdn/sortablejs/modular/sortable.esm.js \
+   '/tmp/cdn/serve/npm/sortablejs@1.15.6/modular/sortable.esm.js'
+
+# Self-signed cert for *.jsdelivr.net
+openssl req -x509 -newkey rsa:2048 -keyout /tmp/cdn/key.pem \
+  -out /tmp/cdn/cert.pem -sha256 -days 365 -nodes \
+  -subj "/CN=cdn.jsdelivr.net" \
+  -addext "subjectAltName=DNS:cdn.jsdelivr.net" 2>/dev/null
+
+# TLS server on :8443 (script lives next to this skill)
+python3 .claude/skills/sandbox-test-setup/assets/cdn_server.py &
+disown
+```
+
+The `--host-resolver-rules` argument (in the override above) routes
+`cdn.jsdelivr.net` → this local server, and `--ignore-certificate-errors`
+trusts the self-signed cert.
+
+## End-to-end recap
+
+Assumes Ruby 4.0.6 is already built. Combines the steps above — but note the
+last line has three prerequisites this block does *not* perform: a
+Chrome-matching chromedriver on PATH, `spec/support/local_chrome.rb` created,
+and `cdn_server.py` running. Do those sections first or that line fails.
+
+```bash
+CHROME_DIR=$(ls -d /opt/pw-browsers/chromium-*/chrome-linux | sort -V | tail -1)
+export PATH="/opt/ruby-4.0.6/x64/bin:$CHROME_DIR:/usr/local/bin:/usr/bin:/bin:/usr/sbin"
+export LD_LIBRARY_PATH="/opt/ruby-4.0.6/x64/lib:$LD_LIBRARY_PATH"
+service postgresql start && service redis-server start
+cd "$REPO_DIR"
+bundle install
+eval "$(ruby bin/env --export)"
+export RAILS_ENV=test CI=1
+bundle exec rails db:migrate db:test:prepare
+bundle exec rails tailwindcss:build           # only if specs render the layout
+
+bundle exec rspec spec/models spec/requests   # plain
+LOCAL_CHROME_OVERRIDE=1 bundle exec rspec spec/components --tag type:system   # system; CDN proxy must be running
+```
+
+## Sandbox network: what's allowed vs. blocked
+
+Quick probe: `curl -sIL --max-time 5 "https://<host>" -o /dev/null -w "%{http_code}\n"`.
+
+- **Allowed**: github.com, codeload.github.com, rubygems.org,
+  registry.npmjs.org, storage.googleapis.com, files.pythonhosted.org.
+- **Blocked**: cache.ruby-lang.org, cdn.jsdelivr.net, most generic CDNs,
+  download.ruby-lang.org, api.github.com.
+
+If a tool's default download URL is blocked, look for a GitHub or
+npm-registry alternative before giving up.
diff --git a/.claude/skills/sandbox-test-setup/assets/cdn_server.py b/.claude/skills/sandbox-test-setup/assets/cdn_server.py
new file mode 100644
index 00000000..626dc02a
--- /dev/null
+++ b/.claude/skills/sandbox-test-setup/assets/cdn_server.py
@@ -0,0 +1,34 @@
+"""Local TLS server that mimics cdn.jsdelivr.net for sandboxed system specs.
+
+Serves /tmp/cdn/serve over HTTPS on 127.0.0.1:8443 with a self-signed cert.
+Pair with Chrome's `--host-resolver-rules=MAP cdn.jsdelivr.net 127.0.0.1:8443`
+and `--ignore-certificate-errors` so importmap-pinned modules resolve locally
+when the egress proxy blocks the real jsdelivr.
+"""
+import http.server
+import os
+import ssl
+
+ROOT = "/tmp/cdn/serve"
+CERT = "/tmp/cdn/cert.pem"
+KEY = "/tmp/cdn/key.pem"
+JS_SUFFIXES = (".mjs", "+esm", ".js")
+
+
+class Handler(http.server.SimpleHTTPRequestHandler):
+    def end_headers(self):
+        self.send_header("Access-Control-Allow-Origin", "*")
+        super().end_headers()
+
+    def guess_type(self, path):
+        if path.endswith(JS_SUFFIXES):
+            return "application/javascript"
+        return super().guess_type(path)
+
+
+os.chdir(ROOT)
+ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+ctx.load_cert_chain(CERT, KEY)
+httpd = http.server.HTTPServer(("127.0.0.1", 8443), Handler)
+httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
+httpd.serve_forever()
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93d009df..d36d2b5e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -75,7 +75,6 @@ jobs:
       PGPORT: 5432
       PGUSER: postgres
       PGPASSWORD: password
-      SKIP_PARALLEL_MIGRATIONS: true
       TZ: "America/Los_Angeles"
       COVERAGE: false # additional configuration is needed for parallelized tests
       RETRY_FLAKY: true
diff --git a/.gitignore b/.gitignore
index 30e02eae..e6b9fc3c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,4 +42,8 @@ yarn-error.log
 # Ignore special configuration env file
 .env.*
 
-.claude/*
+# Ignore local Claude Code settings
+.claude/settings.local.json
+
+# Workspace ID assigned by bin/workspace_setup
+.workspace_id
diff --git a/.mcp.json b/.mcp.json
new file mode 100644
index 00000000..eba76a5b
--- /dev/null
+++ b/.mcp.json
@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@playwright/mcp@latest",
+        "--isolated",
+        "--storage-state=${HOME}/.cache/ms-playwright/mcp-auth.json",
+        "--headless"
+      ]
+    }
+  }
+}
diff --git a/.tool-versions b/.tool-versions
index ded51b6b..80683882 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
-ruby 4.0.2
+ruby 4.0.6
 nodejs 22.17.1
diff --git a/Gemfile b/Gemfile
index cd88dd9c..9e3b0f8d 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,7 +1,7 @@
 source "https://rubygems.org"
 git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
-ruby "4.0.2"
+ruby "4.0.6"
 
 gem "rails"
 
@@ -16,7 +16,6 @@ gem "redis" # Redis itself
 gem "observer" # Required for Ruby 3.4+ (removed from stdlib)
 gem "csv" # Required for Ruby 3.4+ (removed from stdlib)
 gem "sidekiq" # Background job processing (with redis)
-gem "connection_pool", "< 3" # temporary - see github.com/mperham/connection_pool/issues/212
 gem "sinatra" # Used for sidekiq web
 gem "sidekiq-failures" # Show sidekiq failures
 gem "sidekiq-logstash" # Better sidekiq logging
@@ -78,7 +77,8 @@ end
 
 group :development do
   # gem "web-console", ">= 3.3.0" # Access an interactive console on exception pages or by calling "console" anywhere in the code - commented out because annoying
-  gem "listen", ">= 3.0.5", "< 3.2"
+  gem "debug", require: "debug/prelude" # For `debugger` - prelude defines it without loading the session
+  gem "listen"
   gem "rerun" # For restarting sidekiq on file changes
   gem "letter_opener" # For displaying emails in development
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index 91d37188..965f9a99 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.15)
+    action_text-trix (2.1.19)
       railties
     actioncable (8.1.3)
       actionpack (= 8.1.3)
@@ -75,35 +75,25 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.3)
     attr_extras (7.1.0)
-    axe-core-api (4.11.1)
+    axe-core-api (4.12.0)
       dumb_delegator
-      ostruct
-      virtus
-    axe-core-rspec (4.11.1)
-      axe-core-api (= 4.11.1)
-      dumb_delegator
-      ostruct
-      virtus
-    axiom-types (0.1.1)
-      descendants_tracker (~> 0.0.4)
-      ice_nine (~> 0.11.0)
-      thread_safe (~> 0.3, >= 0.3.1)
+    axe-core-rspec (4.12.0)
+      axe-core-api (= 4.12.0)
     base64 (0.3.0)
     bcrypt (3.1.22)
-    bigdecimal (4.1.1)
-    binxtils (0.3.0)
-      activerecord
-      activesupport
+    bigdecimal (4.1.2)
+    binxtils (0.5.2)
       functionable
       loofah
+      rails
       rails-html-sanitizer
-    bootsnap (1.23.0)
+    bootsnap (1.24.6)
       msgpack (~> 1.2)
-    brakeman (8.0.4)
+    brakeman (8.0.5)
       racc
     builder (3.3.0)
     capybara (3.40.0)
@@ -115,62 +105,69 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    chartkick (4.2.1)
+    chartkick (5.2.1)
     childprocess (5.1.0)
       logger (~> 1.5)
     coderay (1.1.3)
-    coercible (1.0.0)
-      descendants_tracker (~> 0.0.1)
-    commonmarker (2.7.0-arm64-darwin)
-    commonmarker (2.7.0-x86_64-linux)
-    concurrent-ruby (1.3.6)
-    connection_pool (2.5.5)
-    crack (0.4.5)
+    commonmarker (2.9.0-arm64-darwin)
+    commonmarker (2.9.0-x86_64-linux)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    crack (1.0.1)
+      bigdecimal
       rexml
-    crass (1.0.6)
-    css_parser (1.14.0)
+    crass (1.0.7)
+    css_parser (3.0.0)
       addressable
-    csv (3.3.5)
+      ssrf_filter (~> 1.5)
+    csv (3.3.6)
     date (3.5.1)
-    descendants_tracker (0.0.4)
-      thread_safe (~> 0.3, >= 0.3.1)
-    devise (5.0.3)
+    debug (1.11.1)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    devise (5.0.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 7.0)
       responders
       warden (~> 1.2.3)
     diff-lcs (1.6.2)
-    dotenv (2.8.1)
-    dotenv-rails (2.8.1)
-      dotenv (= 2.8.1)
-      railties (>= 3.2)
+    dotenv (3.2.0)
+    dotenv-rails (3.2.0)
+      dotenv (= 3.2.0)
+      railties (>= 6.1)
     drb (2.2.3)
     dumb_delegator (1.1.0)
-    erb (6.0.2)
+    erb (6.0.6)
     erubi (1.13.1)
-    factory_bot (6.2.1)
-      activesupport (>= 5.0.0)
-    factory_bot_rails (6.2.0)
-      factory_bot (~> 6.2.0)
-      railties (>= 5.0.0)
-    faraday (2.7.1)
-      faraday-net_http (>= 2.0, < 3.1)
-      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.0.2)
+    factory_bot (6.6.0)
+      activesupport (>= 6.1.0)
+    factory_bot_rails (6.5.1)
+      factory_bot (~> 6.5)
+      railties (>= 6.1.0)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
     fast_blank (1.0.1)
-    ffi (1.15.5)
+    ffi (1.17.4-arm64-darwin)
+    ffi (1.17.4-x86_64-linux-gnu)
     flamegraph (0.9.5)
-    foreman (0.87.2)
-    formatador (1.1.0)
-    functionable (1.1.0)
-    globalid (1.3.0)
+    foreman (0.90.0)
+      thor (~> 1.4)
+    formatador (1.2.3)
+      reline
+    functionable (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
-    groupdate (6.1.0)
-      activesupport (>= 5.2)
-    guard (2.18.0)
+    groupdate (6.8.0)
+      activesupport (>= 7.2)
+    guard (2.20.2)
       formatador (>= 0.2.4)
       listen (>= 2.7, < 4.0)
+      logger (~> 1.6)
       lumberjack (>= 1.0.12, < 2.0)
       nenv (~> 0.1)
       notiffany (~> 0.0)
@@ -182,33 +179,34 @@ GEM
       guard (~> 2.1)
       guard-compat (~> 1.1)
       rspec (>= 2.99.0, < 4.0)
-    hamlit (3.0.3)
+    hamlit (4.0.0)
       temple (>= 0.8.2)
       thor
       tilt
-    hashdiff (1.0.1)
-    honeybadger (6.5.2)
+    hashdiff (1.2.1)
+    honeybadger (6.9.1)
       logger
       ostruct
-    hotwire-livereload (1.2.3)
+    hotwire-livereload (2.1.1)
+      actioncable (>= 7.0.0)
       listen (>= 3.0.0)
-      rails (>= 6.0.0)
-    htmlbeautifier (1.4.2)
+      railties (>= 7.0.0)
+    htmlbeautifier (1.4.3)
     htmlentities (4.3.4)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    ice_nine (0.11.2)
-    importmap-rails (1.1.5)
+    importmap-rails (2.2.3)
       actionpack (>= 6.0.0)
+      activesupport (>= 6.0.0)
       railties (>= 6.0.0)
     io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.3)
-    language_server-protocol (3.17.0.5)
+    json (2.21.1)
+    language_server-protocol (3.17.0.6)
     launchy (3.1.1)
       addressable (~> 2.8)
       childprocess (~> 5.0)
@@ -216,17 +214,18 @@ GEM
     letter_opener (1.10.0)
       launchy (>= 2.2, < 4)
     lint_roller (1.1.0)
-    listen (3.0.8)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
+    listen (3.10.0)
+      logger
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    lograge (0.14.0)
+    lograge (0.15.0)
       actionpack (>= 4)
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
     logstash-event (1.2.02)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lookbook (2.3.14)
@@ -241,25 +240,26 @@ GEM
       view_component (>= 2.0)
       yard (~> 0.9)
       zeitwerk (~> 2.5)
-    lumberjack (1.2.8)
-    mail (2.9.0)
+    lumberjack (1.4.2)
+    mail (2.9.1)
       logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
       net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
     matrix (0.4.3)
     method_source (1.1.0)
     mini_mime (1.1.5)
-    minitest (6.0.4)
+    minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
-    msgpack (1.8.0)
-    mustermann (3.0.4)
-      ruby2_keywords (~> 0.0.1)
+    msgpack (1.8.4)
+    mustermann (3.1.1)
     nenv (0.3.0)
-    net-imap (0.5.12)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-imap (0.6.6)
       date
       net-protocol
     net-pop (0.1.2)
@@ -269,9 +269,9 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.2-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
     notiffany (0.1.3)
       nenv (~> 0.1)
@@ -280,25 +280,25 @@ GEM
     optimist (3.2.1)
     orm_adapter (0.5.0)
     ostruct (0.6.3)
-    pagy (43.5.1)
+    pagy (43.6.1)
       json
       uri
       yaml
-    parallel (1.28.0)
+    parallel (2.1.0)
     parallel_tests (4.10.1)
       parallel
-    parser (3.3.11.1)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     patience_diff (1.2.0)
       optimist (~> 3.0)
     pg (1.6.3-arm64-darwin)
     pg (1.6.3-x86_64-linux)
-    pp (0.6.3)
+    pp (0.6.4)
       prettyprint
-    premailer (1.19.0)
+    premailer (1.29.0)
       addressable
-      css_parser (>= 1.12.0)
+      css_parser (>= 1.19.0)
       htmlentities (>= 4.0.0)
     premailer-rails (1.12.0)
       actionmailer (>= 3)
@@ -306,25 +306,23 @@ GEM
       premailer (~> 1.7, >= 1.7.9)
     prettyprint (0.2.0)
     prism (1.9.0)
-    propshaft (0.6.4)
+    propshaft (1.3.2)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
       rack
-      railties (>= 7.0.0)
-    pry (0.14.1)
+    pry (0.16.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
-    psych (5.3.1)
-      date
-      stringio
-    public_suffix (7.0.0)
-    puma (7.2.0)
+      reline (>= 0.6.0)
+    public_suffix (7.0.5)
+    puma (8.0.2)
       nio4r (~> 2.0)
     racc (1.8.1)
     rack (3.2.6)
-    rack-cors (2.0.0)
-      rack (>= 2.0.0)
-    rack-mini-profiler (3.0.0)
+    rack-cors (3.0.0)
+      logger
+      rack (>= 3.0.14)
+    rack-mini-profiler (4.0.1)
       rack (>= 1.2.0)
     rack-protection (4.2.1)
       base64 (>= 0.1.0)
@@ -359,8 +357,8 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     railties (8.1.3)
       actionpack (= 8.1.3)
@@ -372,20 +370,26 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
+    rake (13.4.2)
     rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
+    rb-inotify (0.11.1)
       ffi (~> 1.0)
-    rdoc (7.2.0)
+    rbs (4.1.0)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     redcarpet (3.6.1)
-    redis (4.8.0)
-    redis-client (0.26.2)
+    redis (5.4.1)
+      redis-client (>= 0.22.0)
+    redis-client (0.30.1)
       connection_pool
-    redlock (2.0.1)
-      redis-client
+    redlock (2.1.0)
+      redis-client (>= 0.14.1, < 1.0.0)
     regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
@@ -425,18 +429,18 @@ GEM
     rspec-support (3.13.7)
     rspec_junit_formatter (0.6.0)
       rspec-core (>= 2, < 4, != 2.12.0)
-    rubocop (1.84.2)
+    rubocop (1.88.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-performance (1.26.1)
@@ -444,22 +448,21 @@ GEM
       rubocop (>= 1.75.0, < 2.0)
       rubocop-ast (>= 1.47.1, < 2.0)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
-    rubyzip (3.2.2)
+    rubyzip (3.4.1)
     securerandom (0.4.1)
-    selenium-webdriver (4.43.0)
+    selenium-webdriver (4.46.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 4.0)
       websocket (~> 1.0)
     shellany (0.0.1)
-    sidekiq (8.0.10)
-      connection_pool (>= 2.5.0)
-      json (>= 2.9.0)
-      logger (>= 1.6.2)
-      rack (>= 3.1.0)
-      redis-client (>= 0.23.2)
+    sidekiq (8.1.6)
+      connection_pool (>= 3.0.0)
+      json (>= 2.16.0)
+      logger (>= 1.7.0)
+      rack (>= 3.2.0)
+      redis-client (>= 0.29.0)
     sidekiq-failures (1.1.0)
       sidekiq (>= 4.0.0)
     sidekiq-logstash (3.3.0)
@@ -472,11 +475,12 @@ GEM
       rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    stackprof (0.2.22)
-    standard (1.54.0)
+    ssrf_filter (1.5.0)
+    stackprof (0.2.28)
+    standard (1.56.0)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.0)
-      rubocop (~> 1.84.0)
+      rubocop (~> 1.88.0)
       standard-custom (~> 1.0.0)
       standard-performance (~> 1.8)
     standard-custom (1.0.2)
@@ -485,25 +489,23 @@ GEM
     standard-performance (1.9.0)
       lint_roller (~> 1.1)
       rubocop-performance (~> 1.26.0)
-    stimulus-rails (1.1.1)
+    stimulus-rails (1.3.4)
       railties (>= 6.0.0)
-    stringio (3.2.0)
-    super_diff (0.18.0)
-      attr_extras (>= 6.2.4)
-      diff-lcs
-      patience_diff
-    tailwindcss-rails (4.4.0)
+    super_diff (0.19.0)
+      attr_extras (>= 6.2.4, < 8)
+      diff-lcs (~> 1.5)
+      patience_diff (~> 1.2)
+    tailwindcss-rails (4.6.0)
       railties (>= 7.0.0)
       tailwindcss-ruby (~> 4.0)
-    tailwindcss-ruby (4.2.2-arm64-darwin)
-    tailwindcss-ruby (4.2.2-x86_64-linux-gnu)
-    temple (0.9.1)
+    tailwindcss-ruby (4.3.3-arm64-darwin)
+    tailwindcss-ruby (4.3.3-x86_64-linux-gnu)
+    temple (0.10.4)
     thor (1.5.0)
-    thread_safe (0.3.6)
-    tilt (2.0.11)
+    tilt (2.8.0)
     timeout (0.6.1)
     tsort (0.2.0)
-    turbo-rails (2.0.20)
+    turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
     turbo_tests (2.2.5)
@@ -517,30 +519,26 @@ GEM
     uri (1.1.1)
     useragent (0.16.11)
     vcr (6.4.0)
-    view_component (4.5.0)
+    view_component (4.12.0)
       actionview (>= 7.1.0)
       activesupport (>= 7.1.0)
       concurrent-ruby (~> 1)
-    virtus (2.0.0)
-      axiom-types (~> 0.1)
-      coercible (~> 1.0)
-      descendants_tracker (~> 0.0, >= 0.0.3)
     warden (1.2.9)
       rack (>= 2.0.9)
-    webmock (3.18.1)
+    webmock (3.26.2)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
     websocket (1.2.11)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yaml (0.4.0)
-    yard (0.9.39)
-    zeitwerk (2.7.5)
+    yard (0.9.45)
+    zeitwerk (2.8.2)
 
 PLATFORMS
   arm64-darwin-21
@@ -558,8 +556,8 @@ DEPENDENCIES
   chartkick
   coderay
   commonmarker
-  connection_pool (< 3)
   csv
+  debug
   devise
   dotenv-rails
   factory_bot_rails
@@ -575,7 +573,7 @@ DEPENDENCIES
   hotwire-livereload
   importmap-rails
   letter_opener
-  listen (>= 3.0.5, < 3.2)
+  listen
   lograge (>= 0.14)
   logstash-event
   lookbook
@@ -615,7 +613,7 @@ DEPENDENCIES
   webmock
 
 RUBY VERSION
-   ruby 4.0.2p0
+  ruby 4.0.6
 
 BUNDLED WITH
-   2.7.2
+  4.0.17
diff --git a/agents.md b/agents.md
index b85cabae..625b6816 100644
--- a/agents.md
+++ b/agents.md
@@ -6,7 +6,11 @@ ConvusRevies is a Rails webapp
 
 Start the dev server with `bin/dev`
 
-This will start a dev server at [http://localhost:3042](http://localhost:3042)
+Run `eval "$(ruby bin/env --export)"` once so `$WORKSPACE_ID`, `$DEV_PORT`, `$BASE_URL`, and `$REDIS_URL` are set. `config/boot.rb` loads `bin/env` for every Ruby entry point, so those are already set inside any Rails process; only export them into the shell when the shell itself reads them (e.g. `curl "$BASE_URL/..."`).
+
+`bin/env` reads the workspace ID from `.workspace_id` (written by `bin/workspace_setup`) and uses it as `$DEV_PORT`, so each checkout gets its own port, its own postgres databases (`convus_reviews_{development,test}_<id>`), and its own redis database. Without a `.workspace_id` — the root checkout — it falls back to port `3009` and the databases go un-suffixed.
+
+Check whether the dev server is up: `curl -fs "$BASE_URL/" >/dev/null`. If it isn't, **stop and ask the user to start it**.
 
 ## Code style
 
@@ -31,13 +35,37 @@ This project uses Rspec for tests. All business logic should be tested.
 - Avoid testing private methods
 - Avoid mocking objects
 
+The `rspec-testing` skill covers the rest of the project-specific style. The `integration-testing` skill covers `:js, type: :system` browser specs — in this project those are the component system specs at `spec/components/**/component_system_spec.rb`.
+
 ## Frontend Development
 
-The `bin/dev` command handles building and updating the assets.
+Uses Stimulus.js for JavaScript and Tailwind CSS for styling. `bin/dev` runs `tailwindcss:watch`; JS is served via importmap with no build step.
+
+The `frontend-conventions` skill covers the `Form::Group`/`Form::Input` components, the `twlink` class, the `number_display` helper, `UI::Time::Component`, the collapse helpers, and ViewComponent rules.
+
+## Pull requests
+
+- When creating a PR, run the `/pr` workflow rather than calling `gh pr create` directly — `/pr` detects frontend diffs, captures desktop+mobile screenshots, and posts them as a `## Screenshots` PR comment.
+- To attach a local image (screenshot, .png/.jpg) to an existing GitHub PR, the `gh` CLI **cannot upload images** — use the `github-upload-image-to-pr` skill, which drives a real browser to GitHub's user-attachments uploader.
 
 # Initial setup
 
 ```bash
-bundle install # install ruby dependencies
-bundle exec rails db:create db:migrate # create the databases
+bin/workspace_setup # assign a workspace ID, then run bin/setup
 ```
+
+`bin/workspace_setup` claims the next free ID from the local `dev_workspaces`
+postgres database, writes it to `.workspace_id` (gitignored), and execs
+`bin/setup` — which installs gems and JS deps, then creates, loads, migrates,
+and seeds the databases. Pass `--without_seeds` to skip seeding and
+`parallel:prepare`. Conductor runs it automatically on workspace creation
+(`conductor.json`).
+
+Use `bin/setup` on its own only when the checkout already has a `.workspace_id`
+(or is the root checkout, which intentionally has none and uses the un-suffixed
+databases).
+
+`bin/workspace_teardown` reverses it: stops `bin/dev`, drops that workspace's
+databases, releases the ID for reuse, and removes `.workspace_id`. It only
+touches databases whose names end in `_<id>`, so the shared un-suffixed ones are
+never at risk. Conductor runs it on workspace deletion.
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 30ef4f82..6ccfd117 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -16,8 +16,8 @@
       <meta name="description" content="<%= page_description %>">
     <% end %>
     <% if Rails.env.development? %>
+      <%# hotwire-livereload v2+ injects its script via Rack middleware — no view helper needed %>
       <link href="/favicon-dev.png" rel="icon" sizes="192x192">
-      <%= hotwire_livereload_tags %>
     <% else %>
       <link href="/favicon.ico" rel="icon" sizes="192x192">
       <link rel="apple-touch-icon-precomposed apple-touch-icon" href="/apple-touch-icon.png">
diff --git a/bin/char_count b/bin/char_count
new file mode 100755
index 00000000..b035851d
--- /dev/null
+++ b/bin/char_count
@@ -0,0 +1,49 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Count the number of non-whitespace characters
+
+require "shellwords"
+
+# If passed an argument, it counts the files and folders at that path
+# Given no argument, it counts files in app, bin, config, lib
+paths = ARGV.empty? ? %w[app bin config lib] : ARGV
+
+def remove_comments(content, file_path)
+  case File.extname(file_path)
+  when ".rb", ".yml", ".yaml"
+    # Ruby/YAML files: remove # comments
+    content.gsub(/#.*$/, "")
+  when ".erb", ".haml", ".html"
+    # Template/HTML files: remove HTML comments and # comments (for ERB)
+    content.gsub(/#.*$/, "").gsub(/<!--.*?-->/m, "")
+  when ".js", ".css", ".scss"
+    # JS/CSS files: remove // and /* */ comments
+    content.gsub(%r{//.*$}, "").gsub(%r{/\*.*?\*/}m, "")
+  when ".md"
+    # Markdown files: remove HTML comments only
+    content.gsub(/<!--.*?-->/m, "")
+  else
+    # don't remove comments - e.g. JSON files (JSON doesn't support comments)
+    content
+  end
+end
+
+# Change to the script's parent directory
+Dir.chdir(File.expand_path("..", __dir__))
+
+# Get all tracked files in the specified paths
+file_extensions = %w[.rb .erb .haml .html .js .css .scss .yml .yaml .json .md]
+files = `git ls-files #{paths.shelljoin}`.split("\n")
+  .select { |file| file_extensions.include?(File.extname(file)) }
+
+# Process all files and count non-whitespace characters
+total_chars = files.sum do |file|
+  next 0 unless File.exist?(file)
+
+  content = File.read(file)
+  content_without_comments = remove_comments(content, file)
+  content_without_comments.gsub(/\s/, "").length
+end
+
+puts total_chars
diff --git a/bin/conductor_teardown b/bin/conductor_teardown
deleted file mode 100755
index 1d8cd2c1..00000000
--- a/bin/conductor_teardown
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/sh
-#/ Usage: bin/conductor_teardown
-#/
-#/ Clean up workspace-specific resources when a Conductor workspace is closed.
-#/ This drops the workspace-specific test databases.
-
-set -e
-cd $(dirname "$0")/..
-
-if [ -z "$CONDUCTOR_WORKSPACE_NAME" ]; then
-  echo "Not running in Conductor (CONDUCTOR_WORKSPACE_NAME not set), skipping teardown."
-  exit 0
-fi
-
-echo "Tearing down Conductor workspace: $CONDUCTOR_WORKSPACE_NAME"
-
-# Drop workspace-specific development databases
-for db in "convus_reviews_development${CONDUCTOR_WORKSPACE_NAME}"; do
-  echo "Dropping database: $db"
-  dropdb --if-exists "$db" 2>/dev/null || true
-done
-
-# Drop workspace-specific test databases
-for db in "convus_reviews_test${CONDUCTOR_WORKSPACE_NAME}"; do
-  echo "Dropping database: $db"
-  dropdb --if-exists "$db" 2>/dev/null || true
-done
-
-# Also drop parallel test databases (TEST_ENV_NUMBER suffixed)
-for i in $(seq 1 8); do
-  for db in "convus_reviews_test${CONDUCTOR_WORKSPACE_NAME}${i}"; do
-    dropdb --if-exists "$db" 2>/dev/null || true
-  done
-done
-
-echo "Conductor teardown complete!"
diff --git a/bin/dev b/bin/dev
index af61a8b9..69e69aae 100755
--- a/bin/dev
+++ b/bin/dev
@@ -16,6 +16,11 @@ redis-server > log/redis.log &
 
 eval "$(ruby bin/env --export)"
 
+# Let the debug gem allow remote connections,
+# but avoid loading until `debugger` is called
+export RUBY_DEBUG_OPEN="true"
+export RUBY_DEBUG_LAZY="true"
+
 # If there is a development specific environment file
 if test -f .env.development; then
   bundle exec foreman start -f Procfile.dev --env .env.development
diff --git a/bin/env b/bin/env
index 2abca892..2f39a3ac 100755
--- a/bin/env
+++ b/bin/env
@@ -5,12 +5,22 @@
 # Required from config/boot.rb so all Rails entry points get these defaults.
 # Can also be run standalone: `eval "$(ruby bin/env --export)"` from bash.
 
-ENV["DEV_PORT"] ||= ENV.fetch("CONDUCTOR_PORT", "3009")
+workspace_file = File.expand_path("../.workspace_id", __dir__)
+if File.exist?(workspace_file)
+  workspace_int = File.read(workspace_file).strip
+  ENV["WORKSPACE_ID"] ||= workspace_int
+  ENV["DEV_PORT"] ||= workspace_int
+end
+
+# The root checkout has no .workspace_id and uses the default port
+ENV["DEV_PORT"] ||= "3009"
 ENV["BASE_URL"] ||= "http://localhost:#{ENV["DEV_PORT"]}"
+# Give each workspace its own redis database so sidekiq and cable don't collide
+ENV["REDIS_URL"] ||= "redis://localhost:6379/#{(ENV["DEV_PORT"].to_i - 1) % 16}"
 
 # When called with --export, print shell export statements for bash scripts
 if ARGV.include?("--export")
-  %w[DEV_PORT BASE_URL].each do |key|
-    puts "export #{key}=#{ENV[key]}"
+  %w[WORKSPACE_ID DEV_PORT BASE_URL REDIS_URL].each do |key|
+    puts "export #{key}=#{ENV[key]}" if ENV[key]
   end
 end
diff --git a/bin/setup b/bin/setup
index efe6bafd..51ab8753 100755
--- a/bin/setup
+++ b/bin/setup
@@ -6,6 +6,8 @@ include FileUtils
 # path to your application root.
 APP_ROOT = File.expand_path("..", __dir__)
 
+without_seeds = ARGV.include?("--without_seeds")
+
 def system!(*args)
   system(*args) || abort("\n== Command #{args} failed ==")
 end
@@ -40,17 +42,47 @@ chdir APP_ROOT do
     puts "Symlinking storage from #{root_storage}..."
     rm_rf "storage"
     ln_sf root_storage, "storage"
+
+    # Symlink node_modules so every workspace shares one install
+    root_node_modules = File.join(root, "node_modules")
+    mkdir_p root_node_modules unless Dir.exist?(root_node_modules)
+    puts "Symlinking node_modules from #{root_node_modules}..."
+    rm_rf "node_modules"
+    ln_sf root_node_modules, "node_modules"
+  end
+
+  puts "== Checking Ruby version =="
+  required_ruby = File.read(".tool-versions")[/ruby (\S+)/, 1]
+  if required_ruby && RUBY_VERSION != required_ruby
+    if ENV["SETUP_RUBY_INSTALLED"]
+      abort "Failed to activate Ruby #{required_ruby} via mise after installing"
+    end
+    abort "mise is required but not found. See https://mise.jdx.dev/" unless system("which mise > /dev/null 2>&1")
+    puts "Ruby #{required_ruby} required (current: #{RUBY_VERSION}), installing via mise..."
+    system!("mise install ruby@#{required_ruby}")
+    exec({"SETUP_RUBY_INSTALLED" => "1"}, "mise", "exec", "--", "ruby", __FILE__, *ARGV)
   end
 
   puts "== Installing dependencies =="
   system! "gem install bundler --conservative"
   system("bundle check") || system!("bundle install")
 
+  # Install JavaScript dependencies (used by bin/lint: herb-tools, standard)
+  system("yarn install")
+
   puts "== Starting redis so database can be migrated =="
   system "redis-server &"
 
   puts "\n== Preparing database =="
-  system "bin/rails db:create db:schema:load db:migrate db:seed"
+  system "bin/rails db:create db:schema:load db:migrate"
+
+  unless without_seeds
+    puts "\n== Seeding database =="
+    system "bin/rails db:seed"
+
+    puts "\n== Preparing test database (including parallelism) =="
+    system! "bin/rake parallel:prepare"
+  end
 
   puts "\n== Removing old logs and tempfiles =="
   system! "bin/rails log:clear tmp:clear"
diff --git a/bin/workspace_setup b/bin/workspace_setup
new file mode 100755
index 00000000..31d13891
--- /dev/null
+++ b/bin/workspace_setup
@@ -0,0 +1,48 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Assigns this checkout a workspace ID and writes it to .workspace_id at the
+# repo root, then runs bin/setup. The ID is loaded by bin/env to populate
+# WORKSPACE_ID. IDs are tracked in the local Postgres `dev_workspaces` database
+# so multiple checkouts on the same machine each get a distinct ID.
+#
+# ID selection: reuse the lowest soft-deleted ID whose deleted_at is older than
+# DELETED_REUSE_DELAY; otherwise allocate MAX(id) + 1 (floor 3072). The delay
+# prevents recycling an ID while stale data tied to it may still be around.
+#
+# Any arguments passed to this script are forwarded to bin/setup.
+
+require "fileutils"
+
+APP_ROOT = Dir.pwd
+WORKSPACE_FILE = File.join(APP_ROOT, ".workspace_id")
+WORKSPACE_DB = "dev_workspaces"
+DELETED_REUSE_DELAY = "3 weeks" # postgres interval
+
+def psql(database, query)
+  output = IO.popen(["psql", "-d", database, "-tAX", "-c", query], &:read)
+  abort "psql failed for #{database}: #{query}" unless $?.success?
+  output.strip
+end
+
+if File.exist?(WORKSPACE_FILE)
+  puts "workspace ID already set: #{File.read(WORKSPACE_FILE).strip}"
+else
+  if psql("postgres", "SELECT 1 FROM pg_database WHERE datname = '#{WORKSPACE_DB}'").empty?
+    system("createdb", WORKSPACE_DB) || abort("Failed to create database #{WORKSPACE_DB}")
+  end
+
+  psql(WORKSPACE_DB, "SET client_min_messages = WARNING; CREATE TABLE IF NOT EXISTS workspace_ids (id INTEGER PRIMARY KEY, deleted_at TIMESTAMP)")
+  reusable = psql(WORKSPACE_DB, "SELECT id FROM workspace_ids WHERE deleted_at < NOW() - INTERVAL '#{DELETED_REUSE_DELAY}' ORDER BY id ASC LIMIT 1")
+  if reusable.empty?
+    next_id = psql(WORKSPACE_DB, "SELECT GREATEST(COALESCE(MAX(id) + 1, 3072), 3072) FROM workspace_ids").to_i
+    psql(WORKSPACE_DB, "INSERT INTO workspace_ids (id) VALUES (#{next_id})")
+  else
+    next_id = reusable.to_i
+    psql(WORKSPACE_DB, "UPDATE workspace_ids SET deleted_at = NULL WHERE id = #{next_id}")
+  end
+  File.write(WORKSPACE_FILE, next_id.to_s)
+  puts "workspace ID set to #{next_id}"
+end
+
+exec File.join(APP_ROOT, "bin/setup"), *ARGV
diff --git a/bin/workspace_teardown b/bin/workspace_teardown
new file mode 100755
index 00000000..ad0605e8
--- /dev/null
+++ b/bin/workspace_teardown
@@ -0,0 +1,81 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Clean up workspace-specific resources for this checkout: stops bin/dev,
+# drops postgres databases whose names end in `_<workspace_id>` (optionally
+# followed by `_replica` and/or a TEST_ENV_NUMBER for parallel test DBs),
+# soft-deletes the row in dev_workspaces.workspace_ids (so the ID can be
+# reused after DELETED_REUSE_DELAY in bin/workspace_setup), and deletes
+# .workspace_id.
+#
+# All output is teed to ~/.workspace_teardown.log so it survives the terminal
+# closing or the workspace folder being removed.
+
+require "fileutils"
+require "time"
+
+APP_ROOT = Dir.pwd
+WORKSPACE_FILE = File.join(APP_ROOT, ".workspace_id")
+WORKSPACE_DB = "dev_workspaces"
+LOG_FILE = File.expand_path("~/.workspace_teardown.log")
+
+def log_line(msg)
+  puts msg
+  File.open(LOG_FILE, "a") { |f| f.puts(msg) }
+end
+
+def psql(database, query)
+  output = IO.popen(["psql", "-d", database, "-tAX", "-c", query], &:read)
+  abort "psql failed for #{database}: #{query}" unless $?.success?
+  output.strip
+end
+
+workspace_id = ENV["WORKSPACE_ID"]
+if (workspace_id.nil? || workspace_id.empty?) && File.exist?(WORKSPACE_FILE)
+  workspace_id = File.read(WORKSPACE_FILE).strip
+end
+
+if workspace_id.nil? || workspace_id.empty?
+  log_line("WORKSPACE_ID not set and .workspace_id missing, skipping teardown.")
+  exit 0
+end
+
+# Constrain workspace_id so it's safe to interpolate into SQL/regex below.
+abort "workspace_id must be a positive integer, got: #{workspace_id.inspect}" unless workspace_id.match?(/\A\d+\z/)
+
+log_line("")
+log_line("=== #{Time.now.iso8601} workspace #{workspace_id} @ #{APP_ROOT} ===")
+
+# Stop bin/dev for this workspace (kill the foreman process group on DEV_PORT)
+listener_pid = IO.popen(["lsof", "-ti", "tcp:#{workspace_id}", "-sTCP:LISTEN"], err: File::NULL, &:read).split.first
+if listener_pid
+  pgid = IO.popen(["ps", "-o", "pgid=", "-p", listener_pid], err: File::NULL, &:read).strip
+  unless pgid.empty?
+    log_line("Stopping bin/dev (port #{workspace_id}, pgid #{pgid})")
+    begin
+      Process.kill("TERM", -pgid.to_i)
+    rescue Errno::ESRCH, Errno::EPERM
+      # process already gone or not ours — fine
+    end
+  end
+end
+
+# Discover postgres databases tied to this workspace_id.
+databases = psql("postgres", "SELECT datname FROM pg_database WHERE datname ~ '_#{workspace_id}(_replica)?[0-9]*$' ORDER BY datname")
+  .split("\n").map(&:strip).reject(&:empty?)
+
+if databases.empty?
+  log_line("No databases found matching workspace_id #{workspace_id}")
+else
+  databases.each do |db|
+    log_line("Dropping database: #{db}")
+    system("dropdb", "--if-exists", db, out: File::NULL, err: File::NULL)
+  end
+end
+
+log_line("Soft-deleting workspace_ids row: #{workspace_id}")
+psql(WORKSPACE_DB, "UPDATE workspace_ids SET deleted_at = NOW() WHERE id = #{workspace_id}")
+
+FileUtils.rm_f(WORKSPACE_FILE)
+
+log_line("Workspace teardown complete!")
diff --git a/conductor.json b/conductor.json
index 286684d5..37f5df9c 100644
--- a/conductor.json
+++ b/conductor.json
@@ -1,5 +1,5 @@
 {
-  "setup": "bin/setup",
+  "setup": "bin/workspace_setup",
   "server": "bin/dev",
-  "teardown": "bin/conductor_teardown"
+  "teardown": "bin/workspace_teardown"
 }
diff --git a/config/database.yml b/config/database.yml
index eaea4758..b154c718 100644
--- a/config/database.yml
+++ b/config/database.yml
@@ -18,11 +18,11 @@ default_local: &default_local
 
 development:
   <<: *default_local
-  database: convus_reviews_development<%= ENV["CONDUCTOR_WORKSPACE_NAME"] %>
+  database: convus_reviews_development<%= "_#{ENV["WORKSPACE_ID"]}" if ENV["WORKSPACE_ID"] %>
 
 test:
   <<: *default_local
-  database: convus_reviews_test<%= ENV["CONDUCTOR_WORKSPACE_NAME"] %><%= ENV["TEST_ENV_NUMBER"] %>
+  database: convus_reviews_test<%= "_#{ENV["WORKSPACE_ID"]}" if ENV["WORKSPACE_ID"] %><%= ENV["TEST_ENV_NUMBER"] %>
 
 production:
   <<: *default
diff --git a/lib/tasks/parallel_migrate.rake b/lib/tasks/parallel_migrate.rake
index cf5636c9..27e01db3 100644
--- a/lib/tasks/parallel_migrate.rake
+++ b/lib/tasks/parallel_migrate.rake
@@ -1,23 +1,27 @@
-# # frozen_string_literal: true
+# frozen_string_literal: true
 
-# # Override the default db:migrate task, so that parallel test databases are created by default
-# # Skip on CI, because CI doesn't use parallel tests
-# if Rails.env.development? && ENV["CI"].blank?
-#   Rake::Task["db:migrate"].enhance do
-#     puts "Running parallel:migrate for test databases..."
-#     system("rake parallel:migrate")
-#     system("rake parallel:prepare")
-#   end
+# Override the default db:migrate task, so that parallel test databases are migrated too.
+# Opt-in only: set PARALLEL_MIGRATIONS to enable (e.g. PARALLEL_MIGRATIONS=true bin/rake db:migrate).
+# Off by default, since parallel test databases aren't always needed and CI doesn't use them.
+if Rails.env.development? && ENV["PARALLEL_MIGRATIONS"].present?
+  # number parallel databases correctly
+  ENV["PARALLEL_TEST_FIRST_IS_1"] = "true"
 
-#   Rake::Task["db:drop"].enhance do
-#     system("rake parallel:drop")
-#   end
+  Rake::Task["db:migrate"].enhance do
+    puts "Running parallel:migrate for test databases..."
+    system("rake parallel:migrate")
+    system("rake parallel:prepare")
+  end
 
-#   Rake::Task["db:create"].enhance do
-#     system("rake parallel:create")
-#   end
+  Rake::Task["db:drop"].enhance do
+    system("rake parallel:drop")
+  end
 
-#   Rake::Task["db:setup"].enhance do
-#     system("rake parallel:setup")
-#   end
-# end
+  Rake::Task["db:create"].enhance do
+    system("rake parallel:create")
+  end
+
+  Rake::Task["db:setup"].enhance do
+    system("rake parallel:setup")
+  end
+end
diff --git a/spec/requests/admin/topic_reviews_request_spec.rb b/spec/requests/admin/topic_reviews_request_spec.rb
index 0e035699..d3b6bc37 100644
--- a/spec/requests/admin/topic_reviews_request_spec.rb
+++ b/spec/requests/admin/topic_reviews_request_spec.rb
@@ -3,8 +3,8 @@
 base_url = "/admin/topic_reviews"
 RSpec.describe base_url, type: :request do
   let(:topic_review) { FactoryBot.create(:topic_review) }
-  let(:start_at) { (Time.current - 1.day) }
-  let(:end_at) { (Time.current + 1.day) }
+  let(:start_at) { Time.current - 1.day }
+  let(:end_at) { Time.current + 1.day }
   let(:valid_params) do
     {
       topic_name: "Example topic",