refactor: lay the repository out by role

local/ held six unrelated things under a name that stopped being true once it became the production runtime: the service, the frontend, the tests, the ops commands, the container definitions and the dependency lock, 65 files with nothing to tell them apart. app/ the service: api/ routers, core/ for identity, database, models, prices and secret loading, and the worker, bootstrap and schema tests/ the twelve suites, no longer inside the shipped package ops/ backup, readiness, dependency audit, security summary infra/ Dockerfiles, gateway templates, ClamAV and storage configuration, the requirements and their hash lock web/ the Site, Kanban and portal pages with their scripts deploy/Dockerfile.api now copies app/ alone, so the tests stop shipping to production; the local image still carries them, because the suites run inside the stack's network. Five kinds of reference had to follow, and each was found by something different rather than by reading. Imports of the form "from . import db" survived a rewrite that only matched "from .db import". Tests kept relative imports of modules that had left the package. A mock.patch target names its module in a string, where no import rewriting can see it. The browser test resolves a fixture by path. And the release gate's markers pointed at local/runtime.py and local/worker.py, which is the decay its new marker test exists to catch — it caught it. Verified from docker compose down -v: the stack starts, all six integration suites, both browser suites and the twenty-nine unit tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
refactor: give the frontend its own directory and split the API into routers
2026-09-21 17:40:57 -03:00 · 2026-09-21 17:22:00 -03:00
92 changed files with 879 additions and 712 deletions
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -16,14 +16,14 @@ jobs:
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: Run fast regression checks
        run: |
-          python3 -m py_compile local/*.py deploy/*.py
+          python3 -m py_compile app/*.py app/**/*.py ops/*.py deploy/*.py
          python3 -m unittest \
-            local.test_dependency_lock \
-            local.test_staging_readiness \
+            tests.test_dependency_lock \
+            tests.test_staging_readiness \
            deploy.test_production_preflight \
-            local.test_pricing \
-            local.test_secrets -v
-          sh -n local/lock_dependencies.sh
+            tests.test_pricing \
+            tests.test_secrets -v
+          sh -n infra/lock_dependencies.sh

  integration:
    name: Integration suite on a real stack
@@ -75,13 +75,13 @@ jobs:
            $COMPOSE exec -T \
              -e SITE_BASE_URL=http://site \
              -e SITE_HOST_HEADER=localhost \
-              api python -m "local.$suite"
+              api python -m "tests.$suite"
          done

      - name: Runtime and retention regressions
        run: |
-          $COMPOSE exec -T api python -m local.retention_test
-          $COMPOSE exec -T api python -m local.runtime_security_test
+          $COMPOSE exec -T api python -m tests.retention_test
+          $COMPOSE exec -T api python -m tests.runtime_security_test

      # These need a real Chrome. They are the only coverage for the artwork
      # editor and the full customer journey, so install google-chrome-stable
@@ -110,8 +110,8 @@ jobs:
            exit 0
          fi
          echo "Using $CHROME_BIN"
-          node local/artwork_browser_test.mjs
-          node local/browser_test.mjs
+          node tests/artwork_browser_test.mjs
+          node tests/browser_test.mjs

      - name: Diagnostics on failure
        if: failure()
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -249,7 +249,7 @@ supports subsequent corrections or scoped enhancements.

 The current implementation target is localhost before any production connection.
 Use `docker-compose.yml`, `.env.example`, and `LOCAL_SETUP.md`. The runtime is in
-`local/`; historical `portal/`, `kanban/`, `agente/`, and `schema.sql` are preserved
+`app/`; historical `portal/`, `kanban/`, `agente/`, and `schema.sql` are preserved
 as references and are not imported or started by Compose.

 - One local `dtf-cloud` Compose project runs seven long-lived services: Site and
@@ -308,10 +308,10 @@ as references and are not imported or started by Compose.
  `security_status` command summarizes authentication, rate-limit, scan, and
  scanner/signature alerts without exposing secrets. Security regression tests,
  exact-runtime Python dependency auditing, and Trivy image reports live under
-  `local/` and `output/security/`; open findings are documented in
+  `app/` and `output/security/`; open findings are documented in
  `SECURITY_REPORT.md` and are not a production-readiness claim.
 - All direct and transitive Python packages are pinned with artifact hashes in
-  `local/requirements.lock`; the API image build requires those hashes. The lock
+  `infra/requirements.lock`; the API image build requires those hashes. The lock
  is regenerated in a disposable Python 3.12 container by
  `local/lock_dependencies.sh`. A fresh exact-runtime audit found no known Python
  advisories on 2026-09-15; this does not cover OS/container findings.
@@ -327,7 +327,7 @@ as references and are not imported or started by Compose.
  not been deployed. Its fail-closed preflight intentionally rejects the current
  source until production adapters, Docker-secret file loading, approved inputs,
  restore rehearsal, image scans, and human security approval are complete.
- `python3 -m local.backup create-and-verify` creates a private, Git-ignored bundle
+- `python3 -m app.backup create-and-verify` creates a private, Git-ignored bundle
  containing a PostgreSQL dump plus every complete, unexpired object already marked
  `clean`. SHA-256 manifests protect both parts. Verification restores the database
  under a UUID name and the object bytes under a UUID MinIO prefix, hashes the
@@ -348,8 +348,8 @@ for this local implementation checkpoint.

 ### Existing assets

- `dtf-site.html`: the Site. Commercial rules, artwork analysis, cart and
-  delivery UI; its behaviour lives in `local/static/site-*.js`.
+- `web/`: the Site (`index.html`), the Kanban and customer portal pages, and
+  the scripts behind them. `web/site-*.js` holds the Site's behaviour.
 - `docs/historico/`: the original specification, endpoint sketch, task plan and
  status report. Background only — they describe a model this system does not
  implement.
@@ -368,7 +368,7 @@ referenced them; recover from Git history if ever needed.
 - The original Site had no backend payment, freight quote, order persistence,
  authentication, purchase history, or real cart persistence. Local order
  persistence, reviewed quotes, mock freight and fake payment now work through
-  `local/static/checkout.js`. The local customer portal now provides accounts and
+  `web/checkout.js`. The local customer portal now provides accounts and
  order history; cart recovery is browser-local. Production account verification,
  recovery, and cross-device cart editing are still absent.
 - Without the local bridge, the original freight fallback remains a stub.
--- a/LOCAL_SETUP.md
+++ b/LOCAL_SETUP.md
@@ -1,6 +1,6 @@
 # DTF local development

-Read `CONTEXT.md` first. The current runtime lives in `local/`; older portal,
+Read `CONTEXT.md` first. The service lives in `app/`; older portal,
 Kanban, agent, requirements, and SQL files are historical prototypes.

 ## Start
@@ -51,7 +51,7 @@ operator interfaces.
 ## Browser test order

 1. Open the Site. Choose **Arquivo por metro** and the manual/table-price path
-   (CDR/AI/PSD/TIFF). Select `local/fixtures/local-test.cdr`. This is deliberately
+   (CDR/AI/PSD/TIFF). Select `tests/fixtures/local-test.cdr`. This is deliberately
   harmless text for upload testing, not a printable CDR file.
 2. Enter **1.01 metres**. The original calculation bills **1.10 m × R$19.90 =
   R$21.89**, with grade 0 and pickup. You can also use your own non-sensitive
@@ -135,15 +135,15 @@ Pricing parity requires Python 3.10+ and Node 22+ on the host, no package instal
 python3 -m unittest local.test_pricing -v
 ```

-This executes the real pricing constants/functions extracted from `dtf-site.html`
+This executes the real pricing constants/functions extracted from `web/site-config.js`
 and compares all four modes, 101 grades, and 11 lengths (4,444 cases) to backend
 pricing, plus assembly and invalid-input checks.

 With the stack healthy, run the integration test (Python standard library only):

 ```bash
-python3 -m local.smoke_test
-python3 -m local.workflow_test
+python3 -m tests.smoke_test
+python3 -m tests.workflow_test
 ```

 It checks direct two-part upload/resume, missing parts, session isolation,
@@ -159,10 +159,10 @@ Security and malware regressions are separate so an authorized harmless EICAR
 test is unmistakable:

 ```bash
-python3 -m local.security_test
-python3 -m local.scanning_test
-docker compose exec -T api python -m local.runtime_security_test
-docker compose exec -T api python -m local.retention_test
+python3 -m tests.security_test
+python3 -m tests.scanning_test
+docker compose exec -T api python3 -m tests.runtime_security_test
+docker compose exec -T api python3 -m tests.retention_test
 ```

 `local.scanning_test` stores an EICAR fixture as `SECURITY-EICAR.cdr`; ClamAV
@@ -172,7 +172,7 @@ is retained for at most three days, so it temporarily appears in alert summaries
 For an automated real-browser walkthrough, install Chrome and use Node 22+:

 ```bash
-node local/browser_test.mjs
+node tests/browser_test.mjs
 ```

 Set `CHROME_BIN` if Chrome is not at `/usr/bin/google-chrome-stable`. The test
@@ -217,7 +217,7 @@ again. The operator can still inspect order records.
 ## Local backup and restore check

 ```bash
-python3 -m local.backup create-and-verify
+python3 -m app.backup create-and-verify
 ```

 This writes a private four-file bundle in `backups/` (ignored by Git and Docker
@@ -234,7 +234,7 @@ checks database counts, bundle hashes, every archived object's hash, and the byt
 downloaded after restore, then removes only the temporary database and objects. It
 never restores over active data. Keep every bundle file private: it contains
 customer data, password hashes, and customer artwork. To verify it again, run
-`python3 -m local.backup verify` followed by the printed
+`python3 -m app.backup verify` followed by the printed
 `backups/...manifest.json` path. Legacy database-only `.dump` backups remain
 verifiable. Scheduling, offsite copies, and a production restore runbook remain
 unfinished.
@@ -242,7 +242,7 @@ unfinished.
 After building the current image, test retention with synthetic files:

 ```bash
-docker compose exec -T api python -m local.retention_test
+docker compose exec -T api python3 -m tests.retention_test
 ```

 This checks that expired bytes are removed while unexpired files survive. It
@@ -270,7 +270,7 @@ exposes `/minio/health/ready`.
 Run the redacted local alert summary inside the API network namespace:

 ```bash
-docker compose exec -T api python -m local.security_status
+docker compose exec -T api python3 -m app.security_status
 ```

 Exit status 1 means attention is required. Review blocked artwork, rate limits,
@@ -306,12 +306,12 @@ Offline PDF previews may fall back to the prototype's manual/table-price path.
 ## Dependency lock

 The API, worker, and database initializer install every Python dependency from
-`local/requirements.lock` with `--require-hashes`. `local/requirements.txt`
+`infra/requirements.lock` with `--require-hashes`. `infra/requirements.txt`
 remains the human-maintained direct dependency list. After deliberately changing
 a direct pin, regenerate the lock in the same Python 3.12 environment and rebuild:

 ```bash
-./local/lock_dependencies.sh
+./infra/lock_dependencies.sh
 docker compose up --build -d --wait
 ```

@@ -339,7 +339,7 @@ contracts and owners. See `staging/README.md`.
 Keep this stack local. Before connecting real services, confirm the production
 checkout trust workflow, complete `PRODUCTION_INPUTS.md`, and pass the isolated
 staging-readiness gate. Then implement the actual staging composition using the adapter contracts in
-`local/adapters.py`: start with private S3 staging storage, CORS, signed multipart
+`app/adapters.py`: start with private S3 staging storage, CORS, signed multipart
 contract tests and scoped credentials injected outside Git. Add provider sandbox
 adapters one at a time. Mercado Pago requires authenticated, signed, idempotent
 webhook handling before real payment is allowed; Tiny/Olist and WhatsApp need
@@ -363,7 +363,7 @@ Run the source-only gate without credentials:
 python3 deploy/production_preflight.py --source-only
 ```

-It must remain blocked while `local/` supports only local fake adapters and does
+It must remain blocked while `app/` supports only local fake adapters and does
 not load Docker secret `*_FILE` settings. Do not bypass or delete this check.
 After approved production implementations and inputs exist, follow
 `PORTAINER.md` and `deploy/PRODUCTION_CHECKLIST.md`; release and deployment
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -12,7 +12,7 @@
 client inputs (1.1, 1.2, 2.10). Block 1 still waits on client inputs for
 1.1/1.2.

-**Last audit:** 2026-09-18, full read of `local/`, `dtf-site.html`, `deploy/`,
+**Last audit:** 2026-09-18, full read of `app/`, `dtf-site.html`, `deploy/`,
 `.gitea/`, docs and legacy prototypes. Findings below carry their audit IDs.

 | Status | Meaning |
@@ -279,7 +279,7 @@ deliberately not bundled here.

 Accounts now live in `dtf_local.operators`, one per person, with `movements.operator`
 and `order_files.created_by` recording who actually acted. Administered from the API
-container with `python -m local.operators` (list, add, password, disable, enable);
+container with `python3 -m app.operators` (list, add, password, disable, enable);
 passwords are read from the terminal so they never reach shell history or the
 process list, and disabling revokes open sessions immediately rather than leaving
 them valid for the rest of the eight-hour window.
@@ -417,9 +417,9 @@ charges. Fix as part of 1.1.
  with a header saying they are background, not instructions.
 - `[x]` 5.3 — Root `requirements.txt` deleted. It pinned by wildcard, listed
  packages the system does not use, and sat next to the hash-locked
-  `local/requirements.lock` inviting the wrong one to be installed. Only historical
+  `infra/requirements.lock` inviting the wrong one to be installed. Only historical
  documentation referred to it.
- `[x]` 5.4 — `pip` removed from `local/requirements.txt` and from the lock. Nothing
+- `[x]` 5.4 — `pip` removed from `infra/requirements.txt` and from the lock. Nothing
  depended on it; it was pinned only because it was listed directly, and installing
  it put a package manager inside the read-only runtime image. The base image's own
  pip performs the hash-enforced install. Verified: the image builds under
--- a/SECURITY_REPORT.md
+++ b/SECURITY_REPORT.md
@@ -84,7 +84,7 @@ not simply increasing the upload limit.
 Run:

 ```bash
-docker compose exec -T api python -m local.security_status
+docker compose exec -T api python3 -m app.security_status
 ```

 An exit status of 1 requires review. At closeout, attention was expected because
@@ -99,7 +99,7 @@ errors, unexplained authentication bursts, or stale signatures as incidents.

 `pip-audit` inspected the exact packages installed in the hash-enforced rebuilt API
 and found no known Python advisories on 2026-09-15. All 26 direct and transitive
-runtime packages are pinned with artifact hashes in `local/requirements.lock`.
+runtime packages are pinned with artifact hashes in `infra/requirements.lock`.
 `local/lock_dependencies.sh` regenerates it in a disposable Python 3.12 container.
 This is a point-in-time package-database result, not proof that the dependencies
 or image are vulnerability-free. Scheduled lock refresh and audit automation remain
--- a/local/init.py
+++ b/local/init.py
--- a/local/adapters.py
+++ b/local/adapters.py
--- a/app/api/init.py
+++ b/app/api/init.py
@@ -0,0 +1,2 @@
+"""HTTP routers, one per resource. They import from local.runtime, never
+from each other or from local.app."""
--- a/app/api/artwork.py
+++ b/app/api/artwork.py
@@ -0,0 +1,49 @@
+"""Operator artwork handling: final files, and the uploads that carry them.
+
+These reuse the customer upload routes with the operator's derived identity, so
+one transport serves both and there is only one place where parts are signed.
+"""
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException
+
+from ..core import db
+from ..artwork import submit_files
+from ..core.auth import operator
+from ..core.models import ArtworkSubmission, UploadStart
+from ..runtime import file_rows, operator_identity
+from .uploads import begin_upload, complete_upload, part_url, upload_status
+
+router = APIRouter()
+
+@router.post('/api/operator/orders/{oid}/uploads')
+def begin_final(oid: UUID, body: UploadStart, user=Depends(operator)):
+    with db.connect() as c:
+        row = c.execute('SELECT state FROM dtf_local.orders WHERE id=%s', (oid,)).fetchone()
+        if not row: raise HTTPException(404, 'Order not found')
+        if row['state'] not in ('rec','tra','cor'): raise HTTPException(409, 'Order is not in artwork review')
+    return begin_upload(body, session_id=operator_identity(user))
+
+@router.get('/api/operator/uploads/{uid}')
+def final_status(uid: UUID, user=Depends(operator)):
+    return upload_status(uid,session_id=operator_identity(user))
+
+@router.post('/api/operator/uploads/{uid}/parts/{number}')
+def final_part(uid: UUID, number: int, user=Depends(operator)):
+    return part_url(uid,number,session_id=operator_identity(user))
+
+@router.post('/api/operator/uploads/{uid}/complete')
+def final_complete(uid: UUID, user=Depends(operator)):
+    return complete_upload(uid,session_id=operator_identity(user))
+
+@router.get('/api/operator/orders/{oid}/files')
+def operator_files(oid: UUID, user=Depends(operator)):
+    with db.connect() as c:
+        return file_rows(c,oid)
+
+@router.post('/api/operator/orders/{oid}/final-files')
+def final_files(oid: UUID, body: ArtworkSubmission, user=Depends(operator)):
+    with db.connect() as c:
+        order = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s FOR UPDATE', (oid,)).fetchone()
+        if not order: raise HTTPException(404, 'Order not found')
+        return submit_files(c,order,body,operator_identity(user),'final',user)
--- a/app/api/customer.py
+++ b/app/api/customer.py
@@ -0,0 +1,116 @@
+"""Customer accounts, their orders, and the corrections they submit."""
+from datetime import datetime, timedelta, timezone
+from uuid import UUID, uuid4
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from psycopg.errors import UniqueViolation
+from psycopg.types.json import Jsonb
+
+from ..core import db
+from ..artwork import submit_files
+from ..core.auth import (DUMMY_PASSWORD_HASH, audit, client_ip, new_session, owner,
+                    password_hash, password_matches, session_row, throttle, transfer_guest)
+from ..core.models import ArtworkSubmission, Login, Register
+from ..runtime import STATES, file_rows, owned_order, storage
+from ..scanning import require_clean
+
+router = APIRouter()
+
+
+def current(request):
+    try: return session_row(request)
+    except HTTPException: return None
+
+
+@router.post('/api/account/register')
+def register(body: Register, request: Request, response: Response):
+    email = body.customer.mail.strip().lower()
+    throttle(email, request)
+    previous = current(request)
+    encoded = password_hash(body.password)
+    identity = uuid4()
+    profile = body.customer.model_dump()
+    profile['mail'] = email
+    try:
+        with db.connect() as c:
+            if previous and c.execute('SELECT id FROM dtf_local.accounts WHERE id=%s', (previous['owner'],)).fetchone():
+                raise HTTPException(409, 'Sign out before registering another account')
+            c.execute('INSERT INTO dtf_local.accounts(id,email,password_hash,profile) VALUES(%s,%s,%s,%s)', (identity,email,encoded,Jsonb(profile)))
+            if previous: transfer_guest(c, previous, identity)
+            new_session(c, response, identity)
+    except UniqueViolation:
+        raise HTTPException(409, 'An account already exists; sign in')
+    audit('account_registered', account=str(identity))
+    return {'customer': profile}
+
+@router.post('/api/account/login')
+def login(body: Login, request: Request, response: Response):
+    email = body.email.strip().lower()
+    throttle(email, request)
+    with db.connect() as c:
+        account = c.execute('SELECT * FROM dtf_local.accounts WHERE email=%s', (email,)).fetchone()
+    # Comparable password work even when the email is absent.
+    stored = account['password_hash'] if account else DUMMY_PASSWORD_HASH
+    matches = password_matches(body.password, stored)
+    if not account or not matches:
+        audit('customer_login_failed', ip=client_ip(request))
+        raise HTTPException(401, 'Invalid email or password')
+    previous = current(request)
+    with db.connect() as c:
+        if not stored.startswith('scrypt-v2$'):
+            c.execute('UPDATE dtf_local.accounts SET password_hash=%s WHERE id=%s', (password_hash(body.password),account['id']))
+        if previous:
+            transfer_guest(c, previous, account['id'])
+            c.execute('DELETE FROM dtf_local.sessions WHERE id=%s', (previous['id'],))
+        new_session(c, response, account['id'])
+    audit('customer_login_success', account=str(account['id']))
+    return {'customer': account['profile']}
+
+@router.post('/api/account/logout')
+def logout(request: Request, response: Response):
+    previous = current(request)
+    if previous:
+        with db.connect() as c:
+            c.execute('DELETE FROM dtf_local.sessions WHERE id=%s', (previous['id'],))
+    response.delete_cookie('dtf_session', httponly=True, samesite='strict')
+    response.headers['Clear-Site-Data'] = '"storage"'
+    audit('customer_logout')
+    return {'ok': True}
+
+@router.get('/api/account/me')
+def me(identity=Depends(owner)):
+    with db.connect() as c:
+        row = c.execute('SELECT profile FROM dtf_local.accounts WHERE id=%s', (identity,)).fetchone()
+    return {'customer': row['profile'] if row else None}
+
+@router.get('/api/customer/orders')
+def orders(identity=Depends(owner)):
+    with db.connect() as c:
+        rows = c.execute('SELECT id,number,state,version,snapshot,created_at,updated_at FROM dtf_local.orders WHERE owner=%s ORDER BY created_at DESC', (identity,)).fetchall()
+        quotes = c.execute('''SELECT q.id,q.approved,q.approved_at,q.created_at FROM dtf_local.quotes q
+            LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE q.owner=%s AND o.id IS NULL ORDER BY q.created_at DESC''', (identity,)).fetchall()
+    return {'orders': rows, 'quotes': quotes, 'states': STATES}
+
+@router.get('/api/customer/orders/{oid}')
+def detail(oid: UUID, identity=Depends(owner)):
+    with db.connect() as c:
+        row = owned_order(c, oid, identity)
+        history = c.execute('SELECT from_state,to_state,reason,created_at FROM dtf_local.movements WHERE order_id=%s ORDER BY id', (oid,)).fetchall()
+        return {'id': row['id'], 'number': row['number'], 'state': row['state'], 'version': row['version'],
+                'snapshot': row['snapshot'], 'history': history, 'files': file_rows(c,oid)}
+
+@router.post('/api/customer/orders/{oid}/corrections')
+def correction(oid: UUID, body: ArtworkSubmission, identity=Depends(owner)):
+    with db.connect() as c:
+        order = owned_order(c, oid, identity, lock=True)
+        return submit_files(c,order,body,identity,'correction','customer')
+
+@router.get('/api/customer/orders/{oid}/files/{fid}/download')
+def customer_download(oid: UUID, fid: UUID, identity=Depends(owner)):
+    with db.connect() as c:
+        owned_order(c,oid,identity)
+        row = c.execute('SELECT u.* FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id WHERE f.id=%s AND f.order_id=%s AND f.active', (fid,oid)).fetchone()
+        if not row: raise HTTPException(404, 'Active file not found')
+        if row['expires_at'] <= datetime.now(timezone.utc): raise HTTPException(410, 'File expired')
+        require_clean(row)
+    return {'url':storage.download(row['object_key'],row['name']), 'name':row['name']}
--- a/app/api/health.py
+++ b/app/api/health.py
@@ -0,0 +1,43 @@
+"""Health, session bootstrap and freight quoting."""
+import os
+
+from fastapi import APIRouter, HTTPException, Request, Response
+
+from ..core import db
+from ..core.auth import client_ip, owner, new_session, rate_limit
+from ..core.models import Freight
+from ..runtime import ENVIRONMENT, GUEST_SESSION_LIMIT, PART_BYTES, freight, storage
+
+router = APIRouter()
+
+@router.get('/health')
+@router.get('/api/health')
+def health():
+    try:
+        with db.connect() as c:
+            c.execute('SELECT 1')
+        storage.health()
+    except Exception:
+        raise HTTPException(503, 'Database or storage unavailable')
+    return {'status': 'ok', 'environment': ENVIRONMENT,
+            'storage': 'minio' if ENVIRONMENT == 'local' else 'r2', 'integrations': 'fake'}
+
+@router.get('/api/session')
+def session(request: Request, response: Response):
+    try:
+        session_id = owner(request)
+    except HTTPException:
+        # Per source, not per deployment: keyed on the environment name this was a
+        # single global bucket, so ~8 new visitors a minute exhausted it site-wide.
+        rate_limit('guest-sessions', client_ip(request), GUEST_SESSION_LIMIT, 900)
+        with db.connect() as c:
+            session_id = new_session(c, response)
+    return {'environment': ENVIRONMENT, 'cart_scope': str(session_id), 'part_bytes': PART_BYTES,
+            'max_upload_bytes': int(os.environ.get('MAX_UPLOAD_BYTES', '5368709120'))}
+
+@router.post('/api/freight')
+def quote_freight(body: Freight):
+    try:
+        return freight.quote(body.service, body.postal_code)
+    except ValueError as exc:
+        raise HTTPException(422, str(exc))
--- a/app/api/operator.py
+++ b/app/api/operator.py
@@ -0,0 +1,146 @@
+"""Kanban: sign-in, the board, commercial review and card movement."""
+import hashlib
+import os
+import secrets
+from datetime import datetime, timedelta, timezone
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from psycopg.types.json import Jsonb
+
+from ..core import db
+from ..core.auth import (COOKIE_SECURE, DUMMY_PASSWORD_HASH, audit, client_ip, operator,
+                    password_matches, throttle)
+from ..core.models import Move, OperatorLogin, Review
+from ..core.pricing import price
+from ..runtime import (BOARD_FINISHED_LIMIT, BOARD_QUOTE_LIMIT, STATES, TRANSITIONS,
+                       enqueue, freight, quote_view, storage, upload_row)
+from ..scanning import require_clean
+
+router = APIRouter()
+
+@router.post('/api/operator/login')
+def operator_login(body: OperatorLogin, request: Request, response: Response):
+    email = body.email
+    throttle('operator:'+email, request)
+    with db.connect() as c:
+        account = c.execute('SELECT * FROM dtf_local.operators WHERE email=%s', (email,)).fetchone()
+        if not c.execute('SELECT 1 FROM dtf_local.operators WHERE active LIMIT 1').fetchone():
+            raise HTTPException(503, 'No Kanban operator account is configured')
+    # Comparable password work whether or not the account exists or is active.
+    stored = account['password_hash'] if account else DUMMY_PASSWORD_HASH
+    matches = password_matches(body.password, stored)
+    if not account or not account['active'] or not matches:
+        audit('operator_login_failed', ip=client_ip(request), operator=email)
+        raise HTTPException(401, 'Invalid operator login')
+    token = secrets.token_urlsafe(32)
+    with db.connect() as c:
+        previous = hashlib.sha256(request.cookies.get('dtf_operator','').encode()).hexdigest()
+        c.execute('DELETE FROM dtf_local.operator_sessions WHERE token_hash=%s', (previous,))
+        c.execute('INSERT INTO dtf_local.operator_sessions(token_hash,username) VALUES(%s,%s)',
+                  (hashlib.sha256(token.encode()).hexdigest(), email))
+        c.execute('UPDATE dtf_local.operators SET last_login_at=now() WHERE id=%s', (account['id'],))
+    response.set_cookie('dtf_operator', token, httponly=True, secure=COOKIE_SECURE,
+                        samesite='strict', path='/api/operator', max_age=28800)
+    audit('operator_login_success', operator=email)
+    return {'ok': True}
+
+@router.post('/api/operator/logout')
+def operator_logout(request: Request, response: Response):
+    with db.connect() as c:
+        digest = hashlib.sha256(request.cookies.get('dtf_operator','').encode()).hexdigest()
+        c.execute('DELETE FROM dtf_local.operator_sessions WHERE token_hash=%s', (digest,))
+    response.delete_cookie('dtf_operator', path='/api/operator', httponly=True,
+                           secure=COOKIE_SECURE, samesite='strict')
+    audit('operator_logout')
+    return {'ok': True}
+
+@router.get('/api/operator/board')
+def board(user=Depends(operator)):
+    with db.connect() as c:
+        # Everything still in progress, however old: an operator must never lose a
+        # card they can act on. Finished orders are terminal and only accumulate,
+        # so the board carries a recent window of them and reports the true total.
+        active = c.execute("SELECT * FROM dtf_local.orders WHERE state<>'fin' ORDER BY created_at").fetchall()
+        finished = c.execute("SELECT * FROM dtf_local.orders WHERE state='fin' ORDER BY created_at DESC LIMIT %s",
+                             (BOARD_FINISHED_LIMIT,)).fetchall()
+        finished_total = c.execute("SELECT count(*) AS n FROM dtf_local.orders WHERE state='fin'").fetchone()['n']
+        quotes = c.execute('''SELECT q.* FROM dtf_local.quotes q
+            LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE o.id IS NULL
+            ORDER BY q.created_at LIMIT %s''', (BOARD_QUOTE_LIMIT,)).fetchall()
+        return {'states': STATES, 'transitions': TRANSITIONS,
+                'orders': active + list(reversed(finished)),
+                'finished_shown': len(finished), 'finished_total': finished_total,
+                'quotes': [quote_view(c, q) for q in quotes],
+                'events': c.execute('SELECT * FROM dtf_local.outbox ORDER BY id DESC LIMIT 100').fetchall()}
+
+@router.post('/api/operator/quotes/{uid}/approve')
+def approve(uid: UUID, body: Review, user=Depends(operator)):
+    with db.connect() as c:
+        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s FOR UPDATE', (uid,)).fetchone()
+        if not row:
+            raise HTTPException(404, 'Quote not found')
+        if row['approved']:
+            raise HTTPException(409, 'Approved quotes are immutable; request a new quote')
+        draft = row['draft']
+        if len(body.items) != len(draft['items']):
+            raise HTTPException(422, 'Review must cover every item')
+        items = []
+        for item, original in zip(body.items, draft['items']):
+            if item.mode != original['mode'] or list(map(str,item.uploads)) != original['uploads']:
+                raise HTTPException(422, 'Product mode and attached files cannot change during review')
+            for upload_id in item.uploads:
+                require_clean(upload_row(c, upload_id, row['owner']))
+            items.append({**price(item.mode, str(item.metres), item.grade), 'uploads': original['uploads']})
+        quoted_freight = freight.quote(**draft['freight'])
+        approved = {'customer': draft['customer'], 'items': items, 'freight': quoted_freight,
+                    'total_cents': sum(i['total_cents'] for i in items)+quoted_freight['total_cents']}
+        c.execute('UPDATE dtf_local.quotes SET approved=%s, reviewed_by=%s, approved_at=now() WHERE id=%s', (Jsonb(approved),user,uid))
+    return approved
+
+@router.post('/api/operator/orders/{uid}/move')
+def move(uid: UUID, body: Move, user=Depends(operator)):
+    with db.connect() as c:
+        row = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s FOR UPDATE', (uid,)).fetchone()
+        if not row:
+            raise HTTPException(404, 'Order not found')
+        if body.version != row['version']:
+            raise HTTPException(409, 'Order changed; refresh the board')
+        if body.state == row['state']:
+            return row
+        if body.state not in TRANSITIONS[row['state']]:
+            raise HTTPException(409, 'Move is not allowed from this state')
+        if body.state == 'cor' and not body.reason.strip():
+            raise HTTPException(422, 'Correction requires a reason')
+        if body.state in ('fil','imp'):
+            coverage = c.execute('SELECT DISTINCT f.item_index FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id WHERE f.order_id=%s AND f.kind=\'final\' AND f.active AND u.expires_at>now() AND u.purged_at IS NULL AND u.scan_state=\'clean\'', (uid,)).fetchall()
+            if {r['item_index'] for r in coverage} != set(range(len(row['snapshot']['items']))):
+                raise HTTPException(409, 'Approve a complete final-file set for every item before queueing')
+        if body.state == 'cor':
+            c.execute("UPDATE dtf_local.order_files SET active=false WHERE order_id=%s AND kind='final'", (uid,))
+        c.execute('INSERT INTO dtf_local.movements(order_id,from_state,to_state,operator,reason) VALUES(%s,%s,%s,%s,%s)',
+                  (uid,row['state'],body.state,user,body.reason))
+        changed = c.execute('UPDATE dtf_local.orders SET state=%s, version=version+1, updated_at=now() WHERE id=%s RETURNING *', (body.state,uid)).fetchone()
+        events = {'imp':'production_started','cor':'correction_needed','fin':'ready'}
+        if body.state in events:
+            for provider in ('tiny','whatsapp'):
+                enqueue(c, f'{uid}:{changed["version"]}:{provider}', provider,
+                        {'order_id':str(uid), 'number':row['number'], 'event':events[body.state], 'reason':body.reason,
+                         'customer_path': f'/portal.html?order={uid}'})
+    return changed
+
+@router.get('/api/operator/orders/{uid}/history')
+def history(uid: UUID, user=Depends(operator)):
+    with db.connect() as c:
+        return c.execute('SELECT * FROM dtf_local.movements WHERE order_id=%s ORDER BY id', (uid,)).fetchall()
+
+@router.get('/api/operator/uploads/{uid}/download')
+def download(uid: UUID, user=Depends(operator)):
+    with db.connect() as c:
+        row = c.execute('SELECT * FROM dtf_local.uploads WHERE id=%s AND complete', (uid,)).fetchone()
+        if not row:
+            raise HTTPException(404, 'Completed upload not found')
+        if row['expires_at'] <= datetime.now(timezone.utc):
+            raise HTTPException(410, 'Artwork retention expired')
+        require_clean(row)
+    return {'name':row['name'], 'url':storage.download(row['object_key'],row['name']), 'expires_in':300}
--- a/app/api/orders.py
+++ b/app/api/orders.py
@@ -0,0 +1,41 @@
+"""Paid orders. Local development payment only; no provider is wired yet."""
+from datetime import datetime, timedelta, timezone
+from uuid import UUID, uuid4
+
+from fastapi import APIRouter, Depends, HTTPException
+from psycopg.types.json import Jsonb
+
+from ..core import db
+from ..core.auth import owner
+from ..core.models import Pay
+from ..runtime import ENVIRONMENT, enqueue, payment, upload_row
+from ..scanning import require_clean
+
+router = APIRouter()
+
+@router.post('/api/orders/dev-paid')
+def dev_paid(body: Pay, session_id=Depends(owner)):
+    if ENVIRONMENT != 'local':
+        raise HTTPException(503, 'Checkout is not configured yet')
+    with db.connect() as c:
+        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s AND owner=%s FOR UPDATE', (body.quote_id,session_id)).fetchone()
+        if not row:
+            raise HTTPException(404, 'Quote not found')
+        existing = c.execute('SELECT * FROM dtf_local.orders WHERE quote_id=%s', (body.quote_id,)).fetchone()
+        if existing:
+            return existing
+        if not row['approved']:
+            raise HTTPException(409, 'An operator must verify length and grade first')
+        if row['approved_at'] < datetime.now(timezone.utc)-timedelta(hours=24):
+            raise HTTPException(409, 'Quote expired; request a new quote')
+        approved = row['approved']
+        for item in approved['items']:
+            for upload_id in item['uploads']:
+                require_clean(upload_row(c, UUID(upload_id), session_id))
+        paid = payment.pay(str(body.quote_id), approved['total_cents'])
+        result = c.execute('INSERT INTO dtf_local.orders(id,quote_id,owner,snapshot,payment) VALUES(%s,%s,%s,%s,%s) RETURNING *',
+            (uuid4(),body.quote_id,session_id,Jsonb(approved),Jsonb(paid))).fetchone()
+        for provider in ('tiny','whatsapp'):
+            enqueue(c, f"{result['id']}:paid:{provider}", provider,
+                    {'order_id': str(result['id']), 'number': result['number'], 'event': 'payment_approved', 'order': approved})
+    return result
--- a/app/api/quotes.py
+++ b/app/api/quotes.py
@@ -0,0 +1,46 @@
+"""Quotes: the customer's cart, and the operator-reviewed version of it."""
+import hashlib
+import json
+from uuid import UUID, uuid4
+
+from fastapi import APIRouter, Depends, HTTPException
+from psycopg.types.json import Jsonb
+
+from ..core import db
+from ..core.auth import owner
+from ..core.models import QuoteRequest
+from ..runtime import freight, quote_view, upload_row
+from ..scanning import require_clean
+
+router = APIRouter()
+
+@router.post('/api/quotes')
+def create_quote(body: QuoteRequest, session_id=Depends(owner)):
+    draft = body.model_dump(mode='json', exclude={'request_key'})
+    digest = hashlib.sha256(json.dumps(draft, sort_keys=True).encode()).hexdigest()
+    try:
+        freight.quote(body.freight.service, body.freight.postal_code)
+    except ValueError as exc:
+        raise HTTPException(422, str(exc))
+    with db.connect() as c:
+        for item in body.items:
+            for uid in item.uploads:
+                row = upload_row(c, uid, session_id)
+                if not row['complete']:
+                    raise HTTPException(409, 'Complete every upload before requesting a quote')
+                require_clean(row)
+        uid = uuid4()
+        c.execute('INSERT INTO dtf_local.quotes(id,owner,request_key,request_hash,draft) VALUES(%s,%s,%s,%s,%s) ON CONFLICT(owner,request_key) DO NOTHING',
+                  (uid, session_id, body.request_key, digest, Jsonb(draft)))
+        row = c.execute('SELECT * FROM dtf_local.quotes WHERE owner=%s AND request_key=%s', (session_id, body.request_key)).fetchone()
+        if row['request_hash'] != digest:
+            raise HTTPException(409, 'Request key already used for a different cart')
+    return {'id': row['id'], 'status': 'pending_review'}
+
+@router.get('/api/quotes/{uid}')
+def get_quote(uid: UUID, session_id=Depends(owner)):
+    with db.connect() as c:
+        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s AND owner=%s', (uid,session_id)).fetchone()
+        if not row:
+            raise HTTPException(404, 'Quote not found')
+        return quote_view(c, row)
--- a/app/api/uploads.py
+++ b/app/api/uploads.py
@@ -0,0 +1,85 @@
+"""Customer uploads: reservation, signed parts, completion.
+
+The operator artwork routes reuse these functions directly with a different
+identity, which is why they are plain functions with a session_id argument.
+"""
+import math
+import os
+from uuid import UUID, uuid4
+
+from botocore.exceptions import ClientError
+from fastapi import APIRouter, Depends, HTTPException
+
+from ..core import db
+from ..core.auth import audit, owner, rate_limit
+from ..core.models import UploadStart
+from ..runtime import PART_BYTES, storage, upload_row
+
+router = APIRouter()
+
+@router.post('/api/uploads')
+def begin_upload(body: UploadStart, session_id=Depends(owner)):
+    if body.size > int(os.environ.get('MAX_UPLOAD_BYTES', '5368709120')):
+        raise HTTPException(413, 'File exceeds the upload limit')
+    uid = uuid4()
+    key = f'originals/{uid}'
+    rate_limit('upload-start', str(session_id), 60, 900)
+    with db.connect() as c:
+        # Serialize reservations across API processes, including changing guest IDs.
+        c.execute('SELECT pg_advisory_xact_lock(804208)')
+        usage = c.execute('''SELECT COALESCE(sum(size),0) AS total,
+            COALESCE(sum(size) FILTER(WHERE owner=%s),0) AS owned,
+            count(*) FILTER(WHERE owner=%s AND NOT complete) AS pending
+            FROM dtf_local.uploads WHERE purged_at IS NULL''', (session_id,session_id)).fetchone()
+        if (usage['total']+body.size > int(os.environ.get('STORAGE_QUOTA_BYTES','53687091200')) or
+            usage['owned']+body.size > int(os.environ.get('OWNER_UPLOAD_QUOTA_BYTES','10737418240')) or
+            usage['pending'] >= int(os.environ.get('MAX_PENDING_UPLOADS','10'))):
+            audit('upload_quota_rejected')
+            raise HTTPException(429, 'Local storage quota or pending upload limit reached')
+        multipart = storage.begin(key)
+        c.execute('INSERT INTO dtf_local.uploads(id,owner,name,size,object_key,multipart_id) VALUES(%s,%s,%s,%s,%s,%s)',
+                  (uid, session_id, body.name, body.size, key, multipart))
+    return {'id': uid, 'part_bytes': PART_BYTES}
+
+@router.get('/api/uploads/{uid}')
+def upload_status(uid: UUID, session_id=Depends(owner)):
+    with db.connect() as c:
+        row = upload_row(c, uid, session_id)
+    parts = [] if row['complete'] else storage.parts(row['object_key'], row['multipart_id'])
+    return {'id': uid, 'complete': row['complete'], 'part_bytes': PART_BYTES,
+            'scan_state':row['scan_state'], 'scan_reason':row['scan_reason'],
+            'parts': [p['PartNumber'] for p in parts]}
+
+@router.post('/api/uploads/{uid}/parts/{part}')
+def part_url(uid: UUID, part: int, session_id=Depends(owner)):
+    with db.connect() as c:
+        row = upload_row(c, uid, session_id)
+    if row['complete'] or not 1 <= part <= math.ceil(row['size'] / PART_BYTES):
+        raise HTTPException(409, 'Invalid part or completed upload')
+    size = min(PART_BYTES, row['size']-(part-1)*PART_BYTES)
+    return {'url': storage.part_url(row['object_key'], row['multipart_id'], part, size)}
+
+@router.post('/api/uploads/{uid}/complete')
+def complete_upload(uid: UUID, session_id=Depends(owner)):
+    with db.connect() as c:
+        row = upload_row(c, uid, session_id, lock=True)
+        if row['complete']:
+            return {'id': uid, 'complete': True}
+        try:
+            existing_size = storage.size(row['object_key'])
+        except ClientError as exc:
+            if exc.response['ResponseMetadata']['HTTPStatusCode'] != 404:
+                raise
+            existing_size = None
+        if existing_size is None:
+            parts = storage.parts(row['object_key'], row['multipart_id'])
+            expected = math.ceil(row['size'] / PART_BYTES)
+            if [p['PartNumber'] for p in parts] != list(range(1, expected+1)) or any(
+                p['Size'] != min(PART_BYTES, row['size'] - i*PART_BYTES) for i,p in enumerate(parts)):
+                raise HTTPException(409, 'Parts are missing or their sizes do not match')
+            storage.complete(row['object_key'], row['multipart_id'], parts)
+            existing_size = storage.size(row['object_key'])
+        if existing_size != row['size']:
+            raise HTTPException(409, 'Stored size differs from declared size')
+        c.execute('UPDATE dtf_local.uploads SET complete=true WHERE id=%s', (uid,))
+    return {'id': uid, 'complete': True}
--- a/app/app.py
+++ b/app/app.py
@@ -0,0 +1,48 @@
+"""The DTF Portal/API service: assembly only.
+
+Configuration and shared helpers are in local.runtime; every route lives in a
+router under local.api. This module creates the application, applies the
+cross-cutting middleware, and includes them.
+"""
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from fastapi.responses import JSONResponse
+from starlette.middleware.trustedhost import TrustedHostMiddleware
+
+from .core import db
+from .core.auth import audit, client_ip
+from .runtime import ALLOWED_HOSTS, ALLOWED_ORIGINS, storage
+from .api import artwork, customer, health, operator, orders, quotes, uploads
+
+
+@asynccontextmanager
+async def lifespan(app):
+    with db.connect() as c:
+        c.execute('SELECT 1 FROM dtf_local.operator_sessions LIMIT 1')
+    storage.health()
+    yield
+
+
+app = FastAPI(title='DTF Portal/API', lifespan=lifespan, docs_url=None, redoc_url=None)
+app.add_middleware(TrustedHostMiddleware, allowed_hosts=ALLOWED_HOSTS)
+
+@app.middleware('http')
+async def safe_headers(request, call_next):
+    if request.method not in ('GET','HEAD','OPTIONS'):
+        origin = request.headers.get('origin')
+        if request.headers.get('sec-fetch-site') == 'cross-site' or (origin and origin not in ALLOWED_ORIGINS):
+            audit('cross_origin_rejected', ip=client_ip(request))
+            return JSONResponse({'detail':'Cross-origin request rejected'}, status_code=403)
+    response = await call_next(request)
+    if response.status_code in (401,403,429) or response.status_code>=500:
+        audit('http_security_event', method=request.method, status=response.status_code, ip=client_ip(request))
+    response.headers['Cache-Control'] = 'no-store'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    response.headers['Referrer-Policy'] = 'no-referrer'
+    return response
+
+
+# Order is not significant: no two routers declare the same path.
+for module in (health, uploads, quotes, orders, operator, customer, artwork):
+    app.include_router(module.router)
--- a/app/artwork.py
+++ b/app/artwork.py
@@ -0,0 +1,50 @@
+"""Attaching artwork to an order: the rules shared by customers and operators.
+
+A customer submits a correction and an operator submits the final set; both go
+through the same checks, so the rule about what may be attached, when, and what
+it does to retention lives in one place.
+"""
+from datetime import datetime, timedelta, timezone
+from uuid import UUID, uuid4
+
+from fastapi import HTTPException
+
+from .runtime import upload_row
+from .scanning import require_clean
+
+def submit_files(c, order, body, identity, kind, actor):
+    if order['version'] != body.version:
+        raise HTTPException(409, 'Order changed. Refresh before submitting files.')
+    if kind == 'final' and order['state'] not in ('rec','tra','cor'):
+        raise HTTPException(409, 'Final files can only change during artwork review')
+    if kind == 'correction' and order['state'] != 'cor':
+        raise HTTPException(409, 'This order is not awaiting artwork correction')
+    if len({f.upload_id for f in body.files}) != len(body.files):
+        raise HTTPException(422, 'Each uploaded file must appear once')
+    count = len(order['snapshot']['items'])
+    if any(f.item_index >= count for f in body.files):
+        raise HTTPException(422, 'Invalid order item')
+    if kind == 'final' and {f.item_index for f in body.files} != set(range(count)):
+        raise HTTPException(422, 'Final-file set must cover every order item')
+    original_ids = [UUID(uid) for item in order['snapshot']['items'] for uid in item['uploads']]
+    first = c.execute('SELECT min(created_at) AS first FROM dtf_local.uploads WHERE id=ANY(%s)', (original_ids,)).fetchone()['first']
+    expiry = first + timedelta(days=30)
+    if expiry <= datetime.now(timezone.utc):
+        raise HTTPException(410, 'Order artwork retention has expired')
+    for ref in body.files:
+        upload = upload_row(c, ref.upload_id, identity, lock=True)
+        if not upload['complete']:
+            raise HTTPException(409, 'Complete all uploads first')
+        require_clean(upload)
+        if c.execute('SELECT id FROM dtf_local.order_files WHERE upload_id=%s', (ref.upload_id,)).fetchone():
+            raise HTTPException(409, 'File is already attached. Upload a new revision.')
+    c.execute('UPDATE dtf_local.order_files SET active=false WHERE order_id=%s AND kind=%s', (order['id'],kind))
+    for ref in body.files:
+        c.execute('INSERT INTO dtf_local.order_files(id,order_id,upload_id,item_index,kind,note,created_by) VALUES(%s,%s,%s,%s,%s,%s,%s)',
+                  (uuid4(),order['id'],ref.upload_id,ref.item_index,kind,body.note,actor))
+        c.execute('UPDATE dtf_local.uploads SET expires_at=LEAST(expires_at,%s) WHERE id=%s', (expiry,ref.upload_id))
+    c.execute('UPDATE dtf_local.orders SET version=version+1,updated_at=now() WHERE id=%s', (order['id'],))
+    if kind == 'final':
+        # Artwork approval, not commercial quote approval, starts original cleanup.
+        c.execute("UPDATE dtf_local.uploads SET expires_at=LEAST(expires_at,now()+interval '7 days') WHERE id=ANY(%s)", (original_ids,))
+    return {'ok': True, 'version': order['version']+1, 'expires_at': expiry}
--- a/local/bootstrap.py
+++ b/local/bootstrap.py
@@ -4,7 +4,7 @@ from pathlib import Path
 from urllib.parse import urlparse
 import psycopg
 from psycopg import sql
-from .secrets import load as load_secret_files
+from .core.secrets import load as load_secret_files
 from .operators import seed_from_environment


--- a/app/core/init.py
+++ b/app/core/init.py
@@ -0,0 +1 @@
+"""Shared foundations: identity, database, models, prices, secret loading."""
--- a/app/core/auth.py
+++ b/app/core/auth.py
@@ -6,7 +6,7 @@ import logging
 import json
 from uuid import UUID, uuid4
 from fastapi import HTTPException, Request
-from .db import connect
+from ..core.db import connect

 COOKIE_SECURE = os.environ.get('COOKIE_SECURE', 'false').lower() == 'true'

--- a/app/core/db.py
+++ b/app/core/db.py
@@ -19,4 +19,5 @@ def connect():

 def initialize():
    with connect() as c:
-        c.execute(Path(__file__).with_name('schema.sql').read_text())
+        # The schema lives at the package root, one level up from core/.
+        c.execute((Path(__file__).resolve().parent.parent / 'schema.sql').read_text())
--- a/app/core/models.py
+++ b/app/core/models.py
--- a/app/core/pricing.py
+++ b/app/core/pricing.py
--- a/app/core/secrets.py
+++ b/app/core/secrets.py
--- a/local/operators.py
+++ b/local/operators.py
@@ -21,8 +21,8 @@ import os
 import sys
 from uuid import uuid4

-from .auth import password_hash
-from .db import connect
+from .core.auth import password_hash
+from .core.db import connect

 MIN_PASSWORD = 12

--- a/app/runtime.py
+++ b/app/runtime.py
@@ -0,0 +1,85 @@
+"""Composition root, and the pieces every router needs.
+
+app.py held the adapters, the configuration, the shared query helpers and all
+nineteen of its routes, so customer.py could not import from it without a cycle
+and was wired instead by passing nine callables into install_routes. Everything
+shared lives here: routers import downwards, never from each other.
+"""
+import os
+from datetime import datetime, timedelta, timezone
+from uuid import uuid5, NAMESPACE_URL
+
+from fastapi import HTTPException
+from psycopg.types.json import Jsonb
+
+from .adapters import FakeFreight, FakePayment, LocalS3Storage, require_runtime
+from .core.secrets import load as load_secret_files
+
+# Secret files must resolve before any configuration below is read.
+load_secret_files()
+require_runtime()
+
+storage = LocalS3Storage()
+payment = FakePayment()
+freight = FakeFreight()
+ENVIRONMENT = os.environ.get('APP_ENV', 'local')
+PUBLIC_ORIGIN = os.environ.get('PUBLIC_ORIGIN', 'http://localhost')
+ALLOWED_HOSTS = [host for host in os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1').split(',') if host]
+ALLOWED_ORIGINS = [origin for origin in os.environ.get('ALLOWED_ORIGINS', PUBLIC_ORIGIN).split(',') if origin]
+# Per source and generous: a browser needs one session and keeps the cookie, but
+# offices and mobile carriers put many real customers behind one address, so a
+# tight per-IP ceiling would lock out the same people the old global one did.
+GUEST_SESSION_LIMIT = int(os.environ.get('GUEST_SESSION_LIMIT', '240'))
+# The board returned every order ever created. Finished ones are terminal, so
+# they were pure growth: at a few hundred a day the response and the page both
+# degrade with no operator benefit.
+BOARD_FINISHED_LIMIT = int(os.environ.get('BOARD_FINISHED_LIMIT', '50'))
+BOARD_QUOTE_LIMIT = int(os.environ.get('BOARD_QUOTE_LIMIT', '100'))
+PART_BYTES = int(os.environ.get('UPLOAD_PART_BYTES', '8388608'))
+if not 5242880 <= PART_BYTES <= 67108864:
+    raise RuntimeError('UPLOAD_PART_BYTES must be between 5 and 64 MiB')
+STATES = {'rec': 'Arte recebida', 'tra': 'Arte tratada', 'fil': 'Fila de impressão',
+          'imp': 'Imprimindo', 'cor': 'Correção', 'fin': 'Finalizado'}
+TRANSITIONS = {'rec': ['tra','cor'], 'tra': ['fil','cor'], 'fil': ['imp','cor'],
+               'imp': ['fin','cor'], 'cor': ['rec','tra'], 'fin': []}
+
+
+def upload_row(c, upload_id, session_id, lock=False):
+    row = c.execute('SELECT * FROM dtf_local.uploads WHERE id=%s AND owner=%s' +
+                    (' FOR UPDATE' if lock else ''), (upload_id, session_id)).fetchone()
+    if not row:
+        raise HTTPException(404, 'Upload not found')
+    days = 30 if row['complete'] else 1
+    if row['purged_at'] or row['expires_at'] <= datetime.now(timezone.utc) or row['created_at'] < datetime.now(timezone.utc) - timedelta(days=days):
+        raise HTTPException(410, 'Upload expired; select the file again')
+    return row
+
+
+def quote_view(c, row):
+    order = c.execute('SELECT id,number,state FROM dtf_local.orders WHERE quote_id=%s', (row['id'],)).fetchone()
+    expired = row['approved_at'] and row['approved_at'] < datetime.now(timezone.utc)-timedelta(hours=24)
+    return {'id': row['id'], 'draft': row['draft'], 'approved': row['approved'],
+            'status': 'paid' if order else 'expired' if expired else 'approved' if row['approved'] else 'pending_review',
+            'order': order}
+
+
+def enqueue(c, event_key, provider, payload):
+    c.execute('INSERT INTO dtf_local.outbox(event_key,provider,payload) VALUES(%s,%s,%s) ON CONFLICT(event_key) DO NOTHING',
+              (event_key, provider, Jsonb(payload)))
+
+
+def owned_order(c, oid, identity, lock=False):
+    row = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s AND owner=%s'+(' FOR UPDATE' if lock else ''), (oid,identity)).fetchone()
+    if not row: raise HTTPException(404, 'Order not found')
+    return row
+
+
+def file_rows(c, oid):
+    return c.execute('''SELECT f.id,f.upload_id,f.item_index,f.kind,f.active,f.note,f.created_at,
+        u.name,u.size,u.expires_at,(u.expires_at<=now()) AS expired
+        FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id
+        WHERE order_id=%s ORDER BY f.created_at''', (oid,)).fetchall()
+
+
+def operator_identity(user):
+    return uuid5(NAMESPACE_URL, 'dtf-local-operator:'+user)
--- a/local/scanning.py
+++ b/local/scanning.py
@@ -4,8 +4,8 @@ import socket
 import struct
 import time
 from fastapi import HTTPException
-from .auth import audit
-from .db import connect
+from .core.auth import audit
+from .core.db import connect

 def require_clean(row):
    if not row['complete'] or row['scan_state'] != 'clean':
--- a/local/schema.sql
+++ b/local/schema.sql
--- a/local/worker.py
+++ b/local/worker.py
@@ -6,8 +6,8 @@ import time
 from http.server import BaseHTTPRequestHandler, HTTPServer
 from psycopg.types.json import Jsonb
 from .adapters import FakeTiny, FakeWhatsApp, LocalS3Storage, require_runtime
-from .secrets import load as load_secret_files
-from .db import connect
+from .core.secrets import load as load_secret_files
+from .core.db import connect
 from .scanning import ClamAV, scan_loop

 load_secret_files()
--- a/compose.local.yaml
+++ b/compose.local.yaml
@@ -9,7 +9,7 @@
 x-app: &app
  build:
    context: .
-    dockerfile: local/Dockerfile
+    dockerfile: infra/Dockerfile
  environment: &environment
    APP_ENV: local
    DATABASE_URL: postgresql://${APP_DB_USER:-dtf_app}:${APP_DB_PASSWORD:-local-app-database-only}@db:5432/${POSTGRES_DB:-dtf_local}
@@ -88,8 +88,8 @@ services:
  db-init:
    build:
      context: .
-      dockerfile: local/Dockerfile
-    command: python -m local.bootstrap
+      dockerfile: infra/Dockerfile
+    command: python -m app.bootstrap
    environment:
      # Local only: the app role keeps a password distinct from the administrator.
      DATABASE_ADMIN_URL: postgresql://${POSTGRES_USER:-dtf_local}:${POSTGRES_PASSWORD:-local-database-only}@db:5432/${POSTGRES_DB:-dtf_local}
@@ -109,7 +109,7 @@ services:
  storage-init:
    build:
      context: .
-      dockerfile: local/Dockerfile.storage-init
+      dockerfile: infra/Dockerfile.storage-init
      args:
        MINIO_IMAGE: ${MINIO_IMAGE:-quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z}
    entrypoint: [/bin/sh, /init.sh]
@@ -128,7 +128,7 @@ services:
    # Built, not bind-mounted: see local/Dockerfile.scanner.
    build:
      context: .
-      dockerfile: local/Dockerfile.scanner
+      dockerfile: infra/Dockerfile.scanner
      args:
        CLAMAV_IMAGE: ${CLAMAV_IMAGE:-clamav/clamav@sha256:9cb27d7660bdf66e9878c832cb433dd8aa152cfbe16f3c2c0084c80b04ae22b4}
    entrypoint: [clamd, --foreground=true, --config-file=/etc/clamav/clamd.conf]
@@ -146,7 +146,7 @@ services:

  api:
    <<: *app
-    command: uvicorn local.app:app --host 0.0.0.0 --port 8000 --no-access-log
+    command: uvicorn app.app:app --host 0.0.0.0 --port 8000 --no-access-log
    depends_on:
      db-init: {condition: service_completed_successfully}
      storage-init: {condition: service_completed_successfully}
@@ -158,7 +158,7 @@ services:

  worker:
    <<: *app
-    command: python -m local.worker
+    command: python -m app.worker
    depends_on:
      api: {condition: service_healthy}
      scanner: {condition: service_healthy}
@@ -171,7 +171,7 @@ services:
  site:
    build:
      context: .
-      dockerfile: local/Dockerfile.web
+      dockerfile: infra/Dockerfile.web
    environment:
      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
    ports:
@@ -193,7 +193,7 @@ services:
  kanban:
    build:
      context: .
-      dockerfile: local/Dockerfile.web
+      dockerfile: infra/Dockerfile.web
    environment:
      WEB_INDEX: kanban.html
      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-http://localhost:${STORAGE_PORT:-9000}}
--- a/compose.staging.yaml
+++ b/compose.staging.yaml
@@ -7,8 +7,8 @@ services:
  readiness:
    build:
      context: .
-      dockerfile: local/Dockerfile
-    command: python -m local.staging_readiness /config/staging.env
+      dockerfile: infra/Dockerfile
+    command: python -m app.staging_readiness /config/staging.env
    volumes:
      - ./staging/staging.env:/config/staging.env:ro
    network_mode: none
--- a/deploy/Dockerfile.api
+++ b/deploy/Dockerfile.api
@@ -18,11 +18,11 @@ RUN apt-get update \
    && rm -rf /var/lib/apt/lists/*

 WORKDIR /app
-COPY local/requirements.txt local/requirements.lock /app/local/
-RUN python -m pip install --no-cache-dir --require-hashes -r local/requirements.lock
-COPY local /app/local
+COPY infra/requirements.txt infra/requirements.lock /app/infra/
+RUN python -m pip install --no-cache-dir --require-hashes -r infra/requirements.lock
+COPY app /app/app
 RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin dtf
 USER 10001:10001
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PYTHONPATH=/app
 EXPOSE 8000
-CMD ["uvicorn", "local.app:app", "--host", "0.0.0.0", "--port", "8000", "--no-access-log"]
+CMD ["uvicorn", "app.app:app", "--host", "0.0.0.0", "--port", "8000", "--no-access-log"]
--- a/deploy/Dockerfile.web
+++ b/deploy/Dockerfile.web
@@ -7,11 +7,11 @@ ARG PYTHON_BASE_IMAGE=python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2
 ARG NGINX_BASE_IMAGE=nginx:alpine@sha256:62ff2089abf5a9ed33bd232895bef5e22f7bb4b200675cec49a5ebc48e3d4ac8
 FROM ${PYTHON_BASE_IMAGE} AS policy
 WORKDIR /build
-COPY dtf-site.html /build/dtf-site.html
-COPY local /build/local
+COPY web /build/web
+COPY infra /build/infra
 COPY deploy /build/deploy
 ENV NGINX_TEMPLATE=/build/deploy/nginx.conf.template
-RUN python local/compile_web.py
+RUN python infra/compile_web.py

 FROM ${NGINX_BASE_IMAGE}
 # Same reason as the API image: a pinned base freezes its packages.
@@ -22,8 +22,8 @@ LABEL org.opencontainers.image.title="DTF Site and Kanban" \
      org.opencontainers.image.source="DTF System repository"
 ENV WEB_INDEX=index.html PUBLIC_HOST=invalid.example S3_PUBLIC_ENDPOINT=https://invalid.example
 COPY --from=policy /build/default.conf.template /etc/nginx/templates/default.conf.template
-COPY dtf-site.html /usr/share/nginx/html/index.html
-COPY local/static/ /usr/share/nginx/html/
+COPY web/ /usr/share/nginx/html/
+
 # The official entrypoint renders the server configuration at startup and Nginx
 # writes its PID/cache files.  Keep the service non-root while granting it
 # ownership of only those runtime locations.  This works in Docker Swarm,
--- a/deploy/production_preflight.py
+++ b/deploy/production_preflight.py
@@ -38,10 +38,10 @@ SOURCE_BLOCKERS = {
    # matching when R2 support landed; they were removed rather than left to rot.
    # What remains is the real blocker: no production payment or messaging adapter
    # exists, so these lines must change before a release can be meaningful.
-    'local/app.py': (
+    'app/runtime.py': (
        'payment = FakePayment()',
    ),
-    'local/worker.py': (
+    'app/worker.py': (
        "adapters = {'tiny': FakeTiny(), 'whatsapp': FakeWhatsApp()}",
    ),
 }
@@ -68,7 +68,7 @@ def secret_loading_errors(root=ROOT):
    import importlib.util
    import tempfile

-    module_path = root / 'local' / 'secrets.py'
+    module_path = root / 'app' / 'core' / 'secrets.py'
    if not module_path.exists():
        return ['local runtime does not load the production Docker secret *_FILE settings']
    try:
@@ -76,7 +76,7 @@ def secret_loading_errors(root=ROOT):
        module = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(module)
    except Exception as exc:
-        return [f'local/secrets.py could not be loaded: {exc}']
+        return [f'app/core/secrets.py could not be loaded: {exc}']

    stack_names = set()
    stack = root / 'deploy' / 'stack.yaml'
@@ -97,7 +97,7 @@ def secret_loading_errors(root=ROOT):
            try:
                module.load(environ)
            except Exception as exc:
-                failures.append(f'{name}_FILE is not resolved by local/secrets.py: {exc}')
+                failures.append(f'{name}_FILE is not resolved by app/core/secrets.py: {exc}')
                continue
            if environ.get(name) != 'resolved-value':
                failures.append(f'{name}_FILE did not produce {name}')
@@ -107,7 +107,7 @@ def secret_loading_errors(root=ROOT):
        except Exception:
            pass
        else:
-            failures.append('local/secrets.py does not fail closed on an unreadable secret')
+            failures.append('app/core/secrets.py does not fail closed on an unreadable secret')
    return failures


--- a/deploy/test_production_preflight.py
+++ b/deploy/test_production_preflight.py
@@ -50,6 +50,26 @@ def valid_config():
    return values


+class SourceMarkerTests(unittest.TestCase):
+    """A marker that stops matching weakens the gate without failing it.
+
+    This is how four markers silently died when the runtime gained R2 support,
+    and how the payment one died again when it moved to runtime.py. Assert that
+    every marker still points at something real.
+    """
+
+    def test_every_marker_is_found_in_its_file(self):
+        from deploy.production_preflight import ROOT, SOURCE_BLOCKERS
+        for relative, markers in SOURCE_BLOCKERS.items():
+            path = ROOT / relative
+            self.assertTrue(path.exists(), f'{relative} no longer exists')
+            text = path.read_text()
+            for marker in markers:
+                self.assertIn(marker, text,
+                              f'{relative} no longer contains {marker!r}: the gate '
+                              'would pass without the condition being resolved')
+
+
 class ProductionPreflightTests(unittest.TestCase):
    def test_structurally_complete_metadata_passes(self):
        self.assertEqual(config_errors(valid_config()), [])
@@ -80,8 +100,8 @@ class ProductionPreflightTests(unittest.TestCase):

    def test_fake_checkout_is_explicitly_blocked(self):
        errors = source_errors()
-        self.assertTrue(any('local/app.py remains local-only' in error for error in errors))
-        self.assertTrue(any('local/worker.py remains local-only' in error for error in errors))
+        self.assertTrue(any('app/runtime.py remains local-only' in error for error in errors))
+        self.assertTrue(any('app/worker.py remains local-only' in error for error in errors))

    def test_secret_reuse_and_incoherent_limits_are_rejected(self):
        values = valid_config()
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -57,7 +57,7 @@ services:

  db-init:
    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
-    command: python -m local.bootstrap
+    command: python -m app.bootstrap
    environment:
      DATABASE_ADMIN_HOST: db
      DATABASE_ADMIN_NAME: dtf
@@ -114,7 +114,7 @@ services:

  worker:
    image: ${API_IMAGE:-gitea.blyzer.com.br/blyzer/dtf-api}:${IMAGE_TAG:-latest}
-    command: python -m local.worker
+    command: python -m app.worker
    environment: *app-environment
    networks: [backend, egress]
    read_only: true
@@ -175,7 +175,7 @@ services:

 configs:
  clamd_config:
-    file: ./local/clamd.conf
+    file: ./infra/clamd.conf

 volumes:
  postgres-data:
--- a/infra/Dockerfile
+++ b/infra/Dockerfile
@@ -5,9 +5,12 @@ RUN apt-get update \
    && apt-get upgrade -y \
    && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
-COPY local/requirements.txt local/requirements.lock /app/local/
-RUN pip install --no-cache-dir --require-hashes -r local/requirements.lock
-COPY local /app/local
+COPY infra/requirements.txt infra/requirements.lock /app/infra/
+RUN pip install --no-cache-dir --require-hashes -r infra/requirements.lock
+COPY app /app/app
+# The local image carries the suites so they can run inside the stack network.
+# deploy/Dockerfile.api deliberately does not: tests are not part of what ships.
+COPY tests /app/tests
 RUN useradd --uid 10001 --create-home dtf
 USER dtf
 ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
--- a/infra/Dockerfile.scanner
+++ b/infra/Dockerfile.scanner
@@ -4,4 +4,4 @@
 # makes an empty directory instead and the container fails to start.
 ARG CLAMAV_IMAGE=clamav/clamav@sha256:9cb27d7660bdf66e9878c832cb433dd8aa152cfbe16f3c2c0084c80b04ae22b4
 FROM ${CLAMAV_IMAGE}
-COPY local/clamd.conf /etc/clamav/clamd.conf
+COPY infra/clamd.conf /etc/clamav/clamd.conf
--- a/infra/Dockerfile.storage-init
+++ b/infra/Dockerfile.storage-init
@@ -1,6 +1,6 @@
 # Provisioning script and policies baked in, for the same reason as the scanner.
 ARG MINIO_IMAGE=quay.io/minio/minio:RELEASE.2025-04-22T22-12-26Z
 FROM ${MINIO_IMAGE}
-COPY local/storage-init.sh /init.sh
-COPY local/storage-policy.json /policy.json
-COPY local/storage-lifecycle.json /lifecycle.json
+COPY infra/storage-init.sh /init.sh
+COPY infra/storage-policy.json /policy.json
+COPY infra/storage-lifecycle.json /lifecycle.json
--- a/infra/Dockerfile.web
+++ b/infra/Dockerfile.web
@@ -1,8 +1,8 @@
 FROM python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9 AS policy
 WORKDIR /build
-COPY dtf-site.html /build/dtf-site.html
-COPY local /build/local
-RUN python local/compile_web.py
+COPY web /build/web
+COPY infra /build/infra
+RUN python infra/compile_web.py

 # Same pinned base as deploy/Dockerfile.web.
 FROM nginx:alpine@sha256:62ff2089abf5a9ed33bd232895bef5e22f7bb4b200675cec49a5ebc48e3d4ac8
@@ -10,5 +10,5 @@ RUN apk upgrade --no-cache
 ENV WEB_INDEX=index.html
 COPY --from=policy /build/default.conf.template /etc/nginx/templates/default.conf.template
 ENV S3_PUBLIC_ENDPOINT=http://localhost:9000
-COPY dtf-site.html /usr/share/nginx/html/index.html
-COPY local/static/ /usr/share/nginx/html/
+COPY web/ /usr/share/nginx/html/
+
--- a/infra/clamd.conf
+++ b/infra/clamd.conf
--- a/infra/compile_web.py
+++ b/infra/compile_web.py
@@ -13,12 +13,12 @@ import re

 root = Path('/build')
 hashes = []
-for html in [root / 'dtf-site.html', *(root / 'local/static').glob('*.html')]:
+for html in (root / 'web').glob('*.html'):
    for attributes, script in re.findall(r'<script\b([^>]*)>(.*?)</script>', html.read_text(), re.S | re.I):
        if not re.search(r'\bsrc\s*=', attributes, re.I) and script.strip():
            hashes.append("'sha256-" + base64.b64encode(hashlib.sha256(script.encode()).digest()).decode() + "'")

-template = Path(os.environ.get('NGINX_TEMPLATE', root / 'local/nginx.conf.template')).read_text()
+template = Path(os.environ.get('NGINX_TEMPLATE', root / 'infra/nginx.conf.template')).read_text()
 rendered = template.replace('@SCRIPT_HASHES@', ' '.join(hashes))
 # Collapse the gap an empty hash list leaves behind, so the policy reads cleanly.
 rendered = re.sub(r"(script-src 'self')\s+;", r'\1;', rendered)
--- a/infra/lock_dependencies.sh
+++ b/infra/lock_dependencies.sh
@@ -10,4 +10,4 @@ docker run --rm \
  --volume "$root:/src" \
  --workdir /src \
  python:3.12-slim \
-  sh -c 'python -m pip install --no-cache-dir --target /tmp/piptools pip==25.3 pip-tools==7.5.2 && PYTHONPATH=/tmp/piptools python -m piptools compile --generate-hashes --allow-unsafe --strip-extras --no-emit-index-url --output-file local/requirements.lock local/requirements.txt'
+  sh -c 'python -m pip install --no-cache-dir --target /tmp/piptools pip==25.3 pip-tools==7.5.2 && PYTHONPATH=/tmp/piptools python -m piptools compile --generate-hashes --allow-unsafe --strip-extras --no-emit-index-url --output-file infra/requirements.lock infra/requirements.txt'
--- a/infra/nginx.conf.template
+++ b/infra/nginx.conf.template
--- a/infra/requirements.lock
+++ b/infra/requirements.lock
--- a/infra/requirements.txt
+++ b/infra/requirements.txt
--- a/infra/storage-init.sh
+++ b/infra/storage-init.sh
--- a/infra/storage-lifecycle.json
+++ b/infra/storage-lifecycle.json
--- a/infra/storage-policy.json
+++ b/infra/storage-policy.json
--- a/local/app.py
+++ b/local/app.py
@@ -1,380 +0,0 @@
-import hashlib
-import json
-import math
-import os
-import secrets
-from contextlib import asynccontextmanager
-from datetime import datetime, timedelta, timezone
-from uuid import UUID, uuid4
-
-from botocore.exceptions import ClientError
-from fastapi import Depends, FastAPI, HTTPException, Request, Response
-from fastapi.responses import JSONResponse
-from starlette.middleware.trustedhost import TrustedHostMiddleware
-from psycopg.types.json import Jsonb
-
-from . import db
-from .secrets import load as load_secret_files
-from .adapters import FakeFreight, FakePayment, LocalS3Storage, require_runtime
-from .models import Freight, Move, Pay, QuoteRequest, Review, UploadStart, OperatorLogin
-from .pricing import price
-from .auth import COOKIE_SECURE, DUMMY_PASSWORD_HASH, client_ip, owner, session_row, new_session, operator, password_matches, throttle, audit, rate_limit
-from .scanning import require_clean
-
-load_secret_files()
-require_runtime()
-storage = LocalS3Storage()
-payment = FakePayment()
-freight = FakeFreight()
-ENVIRONMENT = os.environ.get('APP_ENV', 'local')
-PUBLIC_ORIGIN = os.environ.get('PUBLIC_ORIGIN', 'http://localhost')
-ALLOWED_HOSTS = [host for host in os.environ.get('ALLOWED_HOSTS', 'localhost,127.0.0.1').split(',') if host]
-ALLOWED_ORIGINS = [origin for origin in os.environ.get('ALLOWED_ORIGINS', PUBLIC_ORIGIN).split(',') if origin]
-# Per source and generous: a browser needs one session and keeps the cookie, but
-# offices and mobile carriers put many real customers behind one address, so a
-# tight per-IP ceiling would lock out the same people the old global one did.
-GUEST_SESSION_LIMIT = int(os.environ.get('GUEST_SESSION_LIMIT', '240'))
-# The board returned every order ever created. Finished ones are terminal, so
-# they were pure growth: at a few hundred a day the response and the page both
-# degrade with no operator benefit.
-BOARD_FINISHED_LIMIT = int(os.environ.get('BOARD_FINISHED_LIMIT', '50'))
-BOARD_QUOTE_LIMIT = int(os.environ.get('BOARD_QUOTE_LIMIT', '100'))
-PART_BYTES = int(os.environ.get('UPLOAD_PART_BYTES', '8388608'))
-if not 5242880 <= PART_BYTES <= 67108864:
-    raise RuntimeError('UPLOAD_PART_BYTES must be between 5 and 64 MiB')
-STATES = {'rec': 'Arte recebida', 'tra': 'Arte tratada', 'fil': 'Fila de impressão',
-          'imp': 'Imprimindo', 'cor': 'Correção', 'fin': 'Finalizado'}
-TRANSITIONS = {'rec': ['tra','cor'], 'tra': ['fil','cor'], 'fil': ['imp','cor'],
-               'imp': ['fin','cor'], 'cor': ['rec','tra'], 'fin': []}
-
-@asynccontextmanager
-async def lifespan(app):
-    with db.connect() as c:
-        c.execute('SELECT 1 FROM dtf_local.operator_sessions LIMIT 1')
-    storage.health()
-    yield
-
-app = FastAPI(title='DTF Portal/API', lifespan=lifespan, docs_url=None, redoc_url=None)
-app.add_middleware(TrustedHostMiddleware, allowed_hosts=ALLOWED_HOSTS)
-
-@app.post('/api/operator/login')
-def operator_login(body: OperatorLogin, request: Request, response: Response):
-    email = body.email
-    throttle('operator:'+email, request)
-    with db.connect() as c:
-        account = c.execute('SELECT * FROM dtf_local.operators WHERE email=%s', (email,)).fetchone()
-        if not c.execute('SELECT 1 FROM dtf_local.operators WHERE active LIMIT 1').fetchone():
-            raise HTTPException(503, 'No Kanban operator account is configured')
-    # Comparable password work whether or not the account exists or is active.
-    stored = account['password_hash'] if account else DUMMY_PASSWORD_HASH
-    matches = password_matches(body.password, stored)
-    if not account or not account['active'] or not matches:
-        audit('operator_login_failed', ip=client_ip(request), operator=email)
-        raise HTTPException(401, 'Invalid operator login')
-    token = secrets.token_urlsafe(32)
-    with db.connect() as c:
-        previous = hashlib.sha256(request.cookies.get('dtf_operator','').encode()).hexdigest()
-        c.execute('DELETE FROM dtf_local.operator_sessions WHERE token_hash=%s', (previous,))
-        c.execute('INSERT INTO dtf_local.operator_sessions(token_hash,username) VALUES(%s,%s)',
-                  (hashlib.sha256(token.encode()).hexdigest(), email))
-        c.execute('UPDATE dtf_local.operators SET last_login_at=now() WHERE id=%s', (account['id'],))
-    response.set_cookie('dtf_operator', token, httponly=True, secure=COOKIE_SECURE,
-                        samesite='strict', path='/api/operator', max_age=28800)
-    audit('operator_login_success', operator=email)
-    return {'ok': True}
-
-@app.post('/api/operator/logout')
-def operator_logout(request: Request, response: Response):
-    with db.connect() as c:
-        digest = hashlib.sha256(request.cookies.get('dtf_operator','').encode()).hexdigest()
-        c.execute('DELETE FROM dtf_local.operator_sessions WHERE token_hash=%s', (digest,))
-    response.delete_cookie('dtf_operator', path='/api/operator', httponly=True,
-                           secure=COOKIE_SECURE, samesite='strict')
-    audit('operator_logout')
-    return {'ok': True}
-
-@app.middleware('http')
-async def safe_headers(request, call_next):
-    if request.method not in ('GET','HEAD','OPTIONS'):
-        origin = request.headers.get('origin')
-        if request.headers.get('sec-fetch-site') == 'cross-site' or (origin and origin not in ALLOWED_ORIGINS):
-            audit('cross_origin_rejected', ip=client_ip(request))
-            return JSONResponse({'detail':'Cross-origin request rejected'}, status_code=403)
-    response = await call_next(request)
-    if response.status_code in (401,403,429) or response.status_code>=500:
-        audit('http_security_event', method=request.method, status=response.status_code, ip=client_ip(request))
-    response.headers['Cache-Control'] = 'no-store'
-    response.headers['X-Content-Type-Options'] = 'nosniff'
-    response.headers['Referrer-Policy'] = 'no-referrer'
-    return response
-
-@app.get('/health')
-@app.get('/api/health')
-def health():
-    try:
-        with db.connect() as c:
-            c.execute('SELECT 1')
-        storage.health()
-    except Exception:
-        raise HTTPException(503, 'Database or storage unavailable')
-    return {'status': 'ok', 'environment': ENVIRONMENT,
-            'storage': 'minio' if ENVIRONMENT == 'local' else 'r2', 'integrations': 'fake'}
-
-@app.get('/api/session')
-def session(request: Request, response: Response):
-    try:
-        session_id = owner(request)
-    except HTTPException:
-        # Per source, not per deployment: keyed on the environment name this was a
-        # single global bucket, so ~8 new visitors a minute exhausted it site-wide.
-        rate_limit('guest-sessions', client_ip(request), GUEST_SESSION_LIMIT, 900)
-        with db.connect() as c:
-            session_id = new_session(c, response)
-    return {'environment': ENVIRONMENT, 'cart_scope': str(session_id), 'part_bytes': PART_BYTES,
-            'max_upload_bytes': int(os.environ.get('MAX_UPLOAD_BYTES', '5368709120'))}
-
-@app.post('/api/freight')
-def quote_freight(body: Freight):
-    try:
-        return freight.quote(body.service, body.postal_code)
-    except ValueError as exc:
-        raise HTTPException(422, str(exc))
-
-def upload_row(c, upload_id, session_id, lock=False):
-    row = c.execute('SELECT * FROM dtf_local.uploads WHERE id=%s AND owner=%s' +
-                    (' FOR UPDATE' if lock else ''), (upload_id, session_id)).fetchone()
-    if not row:
-        raise HTTPException(404, 'Upload not found')
-    days = 30 if row['complete'] else 1
-    if row['purged_at'] or row['expires_at'] <= datetime.now(timezone.utc) or row['created_at'] < datetime.now(timezone.utc) - timedelta(days=days):
-        raise HTTPException(410, 'Upload expired; select the file again')
-    return row
-
-@app.post('/api/uploads')
-def begin_upload(body: UploadStart, session_id=Depends(owner)):
-    if body.size > int(os.environ.get('MAX_UPLOAD_BYTES', '5368709120')):
-        raise HTTPException(413, 'File exceeds the upload limit')
-    uid = uuid4()
-    key = f'originals/{uid}'
-    rate_limit('upload-start', str(session_id), 60, 900)
-    with db.connect() as c:
-        # Serialize reservations across API processes, including changing guest IDs.
-        c.execute('SELECT pg_advisory_xact_lock(804208)')
-        usage = c.execute('''SELECT COALESCE(sum(size),0) AS total,
-            COALESCE(sum(size) FILTER(WHERE owner=%s),0) AS owned,
-            count(*) FILTER(WHERE owner=%s AND NOT complete) AS pending
-            FROM dtf_local.uploads WHERE purged_at IS NULL''', (session_id,session_id)).fetchone()
-        if (usage['total']+body.size > int(os.environ.get('STORAGE_QUOTA_BYTES','53687091200')) or
-            usage['owned']+body.size > int(os.environ.get('OWNER_UPLOAD_QUOTA_BYTES','10737418240')) or
-            usage['pending'] >= int(os.environ.get('MAX_PENDING_UPLOADS','10'))):
-            audit('upload_quota_rejected')
-            raise HTTPException(429, 'Local storage quota or pending upload limit reached')
-        multipart = storage.begin(key)
-        c.execute('INSERT INTO dtf_local.uploads(id,owner,name,size,object_key,multipart_id) VALUES(%s,%s,%s,%s,%s,%s)',
-                  (uid, session_id, body.name, body.size, key, multipart))
-    return {'id': uid, 'part_bytes': PART_BYTES}
-
-@app.get('/api/uploads/{uid}')
-def upload_status(uid: UUID, session_id=Depends(owner)):
-    with db.connect() as c:
-        row = upload_row(c, uid, session_id)
-    parts = [] if row['complete'] else storage.parts(row['object_key'], row['multipart_id'])
-    return {'id': uid, 'complete': row['complete'], 'part_bytes': PART_BYTES,
-            'scan_state':row['scan_state'], 'scan_reason':row['scan_reason'],
-            'parts': [p['PartNumber'] for p in parts]}
-
-@app.post('/api/uploads/{uid}/parts/{part}')
-def part_url(uid: UUID, part: int, session_id=Depends(owner)):
-    with db.connect() as c:
-        row = upload_row(c, uid, session_id)
-    if row['complete'] or not 1 <= part <= math.ceil(row['size'] / PART_BYTES):
-        raise HTTPException(409, 'Invalid part or completed upload')
-    size = min(PART_BYTES, row['size']-(part-1)*PART_BYTES)
-    return {'url': storage.part_url(row['object_key'], row['multipart_id'], part, size)}
-
-@app.post('/api/uploads/{uid}/complete')
-def complete_upload(uid: UUID, session_id=Depends(owner)):
-    with db.connect() as c:
-        row = upload_row(c, uid, session_id, lock=True)
-        if row['complete']:
-            return {'id': uid, 'complete': True}
-        try:
-            existing_size = storage.size(row['object_key'])
-        except ClientError as exc:
-            if exc.response['ResponseMetadata']['HTTPStatusCode'] != 404:
-                raise
-            existing_size = None
-        if existing_size is None:
-            parts = storage.parts(row['object_key'], row['multipart_id'])
-            expected = math.ceil(row['size'] / PART_BYTES)
-            if [p['PartNumber'] for p in parts] != list(range(1, expected+1)) or any(
-                p['Size'] != min(PART_BYTES, row['size'] - i*PART_BYTES) for i,p in enumerate(parts)):
-                raise HTTPException(409, 'Parts are missing or their sizes do not match')
-            storage.complete(row['object_key'], row['multipart_id'], parts)
-            existing_size = storage.size(row['object_key'])
-        if existing_size != row['size']:
-            raise HTTPException(409, 'Stored size differs from declared size')
-        c.execute('UPDATE dtf_local.uploads SET complete=true WHERE id=%s', (uid,))
-    return {'id': uid, 'complete': True}
-
-@app.post('/api/quotes')
-def create_quote(body: QuoteRequest, session_id=Depends(owner)):
-    draft = body.model_dump(mode='json', exclude={'request_key'})
-    digest = hashlib.sha256(json.dumps(draft, sort_keys=True).encode()).hexdigest()
-    try:
-        freight.quote(body.freight.service, body.freight.postal_code)
-    except ValueError as exc:
-        raise HTTPException(422, str(exc))
-    with db.connect() as c:
-        for item in body.items:
-            for uid in item.uploads:
-                row = upload_row(c, uid, session_id)
-                if not row['complete']:
-                    raise HTTPException(409, 'Complete every upload before requesting a quote')
-                require_clean(row)
-        uid = uuid4()
-        c.execute('INSERT INTO dtf_local.quotes(id,owner,request_key,request_hash,draft) VALUES(%s,%s,%s,%s,%s) ON CONFLICT(owner,request_key) DO NOTHING',
-                  (uid, session_id, body.request_key, digest, Jsonb(draft)))
-        row = c.execute('SELECT * FROM dtf_local.quotes WHERE owner=%s AND request_key=%s', (session_id, body.request_key)).fetchone()
-        if row['request_hash'] != digest:
-            raise HTTPException(409, 'Request key already used for a different cart')
-    return {'id': row['id'], 'status': 'pending_review'}
-
-def quote_view(c, row):
-    order = c.execute('SELECT id,number,state FROM dtf_local.orders WHERE quote_id=%s', (row['id'],)).fetchone()
-    expired = row['approved_at'] and row['approved_at'] < datetime.now(timezone.utc)-timedelta(hours=24)
-    return {'id': row['id'], 'draft': row['draft'], 'approved': row['approved'],
-            'status': 'paid' if order else 'expired' if expired else 'approved' if row['approved'] else 'pending_review',
-            'order': order}
-
-@app.get('/api/quotes/{uid}')
-def get_quote(uid: UUID, session_id=Depends(owner)):
-    with db.connect() as c:
-        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s AND owner=%s', (uid,session_id)).fetchone()
-        if not row:
-            raise HTTPException(404, 'Quote not found')
-        return quote_view(c, row)
-
-def enqueue(c, event_key, provider, payload):
-    c.execute('INSERT INTO dtf_local.outbox(event_key,provider,payload) VALUES(%s,%s,%s) ON CONFLICT(event_key) DO NOTHING',
-              (event_key, provider, Jsonb(payload)))
-
-@app.post('/api/orders/dev-paid')
-def dev_paid(body: Pay, session_id=Depends(owner)):
-    if ENVIRONMENT != 'local':
-        raise HTTPException(503, 'Checkout is not configured yet')
-    with db.connect() as c:
-        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s AND owner=%s FOR UPDATE', (body.quote_id,session_id)).fetchone()
-        if not row:
-            raise HTTPException(404, 'Quote not found')
-        existing = c.execute('SELECT * FROM dtf_local.orders WHERE quote_id=%s', (body.quote_id,)).fetchone()
-        if existing:
-            return existing
-        if not row['approved']:
-            raise HTTPException(409, 'An operator must verify length and grade first')
-        if row['approved_at'] < datetime.now(timezone.utc)-timedelta(hours=24):
-            raise HTTPException(409, 'Quote expired; request a new quote')
-        approved = row['approved']
-        for item in approved['items']:
-            for upload_id in item['uploads']:
-                require_clean(upload_row(c, UUID(upload_id), session_id))
-        paid = payment.pay(str(body.quote_id), approved['total_cents'])
-        result = c.execute('INSERT INTO dtf_local.orders(id,quote_id,owner,snapshot,payment) VALUES(%s,%s,%s,%s,%s) RETURNING *',
-            (uuid4(),body.quote_id,session_id,Jsonb(approved),Jsonb(paid))).fetchone()
-        for provider in ('tiny','whatsapp'):
-            enqueue(c, f"{result['id']}:paid:{provider}", provider,
-                    {'order_id': str(result['id']), 'number': result['number'], 'event': 'payment_approved', 'order': approved})
-    return result
-
-@app.get('/api/operator/board')
-def board(user=Depends(operator)):
-    with db.connect() as c:
-        # Everything still in progress, however old: an operator must never lose a
-        # card they can act on. Finished orders are terminal and only accumulate,
-        # so the board carries a recent window of them and reports the true total.
-        active = c.execute("SELECT * FROM dtf_local.orders WHERE state<>'fin' ORDER BY created_at").fetchall()
-        finished = c.execute("SELECT * FROM dtf_local.orders WHERE state='fin' ORDER BY created_at DESC LIMIT %s",
-                             (BOARD_FINISHED_LIMIT,)).fetchall()
-        finished_total = c.execute("SELECT count(*) AS n FROM dtf_local.orders WHERE state='fin'").fetchone()['n']
-        quotes = c.execute('''SELECT q.* FROM dtf_local.quotes q
-            LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE o.id IS NULL
-            ORDER BY q.created_at LIMIT %s''', (BOARD_QUOTE_LIMIT,)).fetchall()
-        return {'states': STATES, 'transitions': TRANSITIONS,
-                'orders': active + list(reversed(finished)),
-                'finished_shown': len(finished), 'finished_total': finished_total,
-                'quotes': [quote_view(c, q) for q in quotes],
-                'events': c.execute('SELECT * FROM dtf_local.outbox ORDER BY id DESC LIMIT 100').fetchall()}
-
-@app.post('/api/operator/quotes/{uid}/approve')
-def approve(uid: UUID, body: Review, user=Depends(operator)):
-    with db.connect() as c:
-        row = c.execute('SELECT * FROM dtf_local.quotes WHERE id=%s FOR UPDATE', (uid,)).fetchone()
-        if not row:
-            raise HTTPException(404, 'Quote not found')
-        if row['approved']:
-            raise HTTPException(409, 'Approved quotes are immutable; request a new quote')
-        draft = row['draft']
-        if len(body.items) != len(draft['items']):
-            raise HTTPException(422, 'Review must cover every item')
-        items = []
-        for item, original in zip(body.items, draft['items']):
-            if item.mode != original['mode'] or list(map(str,item.uploads)) != original['uploads']:
-                raise HTTPException(422, 'Product mode and attached files cannot change during review')
-            for upload_id in item.uploads:
-                require_clean(upload_row(c, upload_id, row['owner']))
-            items.append({**price(item.mode, str(item.metres), item.grade), 'uploads': original['uploads']})
-        quoted_freight = freight.quote(**draft['freight'])
-        approved = {'customer': draft['customer'], 'items': items, 'freight': quoted_freight,
-                    'total_cents': sum(i['total_cents'] for i in items)+quoted_freight['total_cents']}
-        c.execute('UPDATE dtf_local.quotes SET approved=%s, reviewed_by=%s, approved_at=now() WHERE id=%s', (Jsonb(approved),user,uid))
-    return approved
-
-@app.post('/api/operator/orders/{uid}/move')
-def move(uid: UUID, body: Move, user=Depends(operator)):
-    with db.connect() as c:
-        row = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s FOR UPDATE', (uid,)).fetchone()
-        if not row:
-            raise HTTPException(404, 'Order not found')
-        if body.version != row['version']:
-            raise HTTPException(409, 'Order changed; refresh the board')
-        if body.state == row['state']:
-            return row
-        if body.state not in TRANSITIONS[row['state']]:
-            raise HTTPException(409, 'Move is not allowed from this state')
-        if body.state == 'cor' and not body.reason.strip():
-            raise HTTPException(422, 'Correction requires a reason')
-        if body.state in ('fil','imp'):
-            coverage = c.execute('SELECT DISTINCT f.item_index FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id WHERE f.order_id=%s AND f.kind=\'final\' AND f.active AND u.expires_at>now() AND u.purged_at IS NULL AND u.scan_state=\'clean\'', (uid,)).fetchall()
-            if {r['item_index'] for r in coverage} != set(range(len(row['snapshot']['items']))):
-                raise HTTPException(409, 'Approve a complete final-file set for every item before queueing')
-        if body.state == 'cor':
-            c.execute("UPDATE dtf_local.order_files SET active=false WHERE order_id=%s AND kind='final'", (uid,))
-        c.execute('INSERT INTO dtf_local.movements(order_id,from_state,to_state,operator,reason) VALUES(%s,%s,%s,%s,%s)',
-                  (uid,row['state'],body.state,user,body.reason))
-        changed = c.execute('UPDATE dtf_local.orders SET state=%s, version=version+1, updated_at=now() WHERE id=%s RETURNING *', (body.state,uid)).fetchone()
-        events = {'imp':'production_started','cor':'correction_needed','fin':'ready'}
-        if body.state in events:
-            for provider in ('tiny','whatsapp'):
-                enqueue(c, f'{uid}:{changed["version"]}:{provider}', provider,
-                        {'order_id':str(uid), 'number':row['number'], 'event':events[body.state], 'reason':body.reason,
-                         'customer_path': f'/portal.html?order={uid}'})
-    return changed
-
-@app.get('/api/operator/orders/{uid}/history')
-def history(uid: UUID, user=Depends(operator)):
-    with db.connect() as c:
-        return c.execute('SELECT * FROM dtf_local.movements WHERE order_id=%s ORDER BY id', (uid,)).fetchall()
-
-@app.get('/api/operator/uploads/{uid}/download')
-def download(uid: UUID, user=Depends(operator)):
-    with db.connect() as c:
-        row = c.execute('SELECT * FROM dtf_local.uploads WHERE id=%s AND complete', (uid,)).fetchone()
-        if not row:
-            raise HTTPException(404, 'Completed upload not found')
-        if row['expires_at'] <= datetime.now(timezone.utc):
-            raise HTTPException(410, 'Artwork retention expired')
-        require_clean(row)
-    return {'name':row['name'], 'url':storage.download(row['object_key'],row['name']), 'expires_in':300}
-
-from .customer import install_routes
-install_routes(app, operator, storage, begin_upload, upload_status, part_url, complete_upload, upload_row, STATES)
--- a/local/customer.py
+++ b/local/customer.py
@@ -1,191 +0,0 @@
-"""Customer portal and manual artwork handoff, composed into the local API."""
-from datetime import datetime, timedelta, timezone
-from uuid import UUID, uuid4, uuid5, NAMESPACE_URL
-from fastapi import Depends, HTTPException, Request, Response
-from psycopg.errors import UniqueViolation
-from psycopg.types.json import Jsonb
-from . import db
-from .auth import owner, session_row, new_session, password_hash, password_matches, transfer_guest, throttle, DUMMY_PASSWORD_HASH, audit, client_ip
-from .models import Register, Login, UploadStart, ArtworkSubmission
-from .scanning import require_clean
-
-def install_routes(app, operator, storage, begin, status, part, complete, upload_row, states):
-    def current(request):
-        try: return session_row(request)
-        except HTTPException: return None
-
-    @app.post('/api/account/register')
-    def register(body: Register, request: Request, response: Response):
-        email = body.customer.mail.strip().lower()
-        throttle(email, request)
-        previous = current(request)
-        encoded = password_hash(body.password)
-        identity = uuid4()
-        profile = body.customer.model_dump()
-        profile['mail'] = email
-        try:
-            with db.connect() as c:
-                if previous and c.execute('SELECT id FROM dtf_local.accounts WHERE id=%s', (previous['owner'],)).fetchone():
-                    raise HTTPException(409, 'Sign out before registering another account')
-                c.execute('INSERT INTO dtf_local.accounts(id,email,password_hash,profile) VALUES(%s,%s,%s,%s)', (identity,email,encoded,Jsonb(profile)))
-                if previous: transfer_guest(c, previous, identity)
-                new_session(c, response, identity)
-        except UniqueViolation:
-            raise HTTPException(409, 'An account already exists; sign in')
-        audit('account_registered', account=str(identity))
-        return {'customer': profile}
-
-    @app.post('/api/account/login')
-    def login(body: Login, request: Request, response: Response):
-        email = body.email.strip().lower()
-        throttle(email, request)
-        with db.connect() as c:
-            account = c.execute('SELECT * FROM dtf_local.accounts WHERE email=%s', (email,)).fetchone()
-        # Comparable password work even when the email is absent.
-        stored = account['password_hash'] if account else DUMMY_PASSWORD_HASH
-        matches = password_matches(body.password, stored)
-        if not account or not matches:
-            audit('customer_login_failed', ip=client_ip(request))
-            raise HTTPException(401, 'Invalid email or password')
-        previous = current(request)
-        with db.connect() as c:
-            if not stored.startswith('scrypt-v2$'):
-                c.execute('UPDATE dtf_local.accounts SET password_hash=%s WHERE id=%s', (password_hash(body.password),account['id']))
-            if previous:
-                transfer_guest(c, previous, account['id'])
-                c.execute('DELETE FROM dtf_local.sessions WHERE id=%s', (previous['id'],))
-            new_session(c, response, account['id'])
-        audit('customer_login_success', account=str(account['id']))
-        return {'customer': account['profile']}
-
-    @app.post('/api/account/logout')
-    def logout(request: Request, response: Response):
-        previous = current(request)
-        if previous:
-            with db.connect() as c:
-                c.execute('DELETE FROM dtf_local.sessions WHERE id=%s', (previous['id'],))
-        response.delete_cookie('dtf_session', httponly=True, samesite='strict')
-        response.headers['Clear-Site-Data'] = '"storage"'
-        audit('customer_logout')
-        return {'ok': True}
-
-    @app.get('/api/account/me')
-    def me(identity=Depends(owner)):
-        with db.connect() as c:
-            row = c.execute('SELECT profile FROM dtf_local.accounts WHERE id=%s', (identity,)).fetchone()
-        return {'customer': row['profile'] if row else None}
-
-    def owned_order(c, oid, identity, lock=False):
-        row = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s AND owner=%s'+(' FOR UPDATE' if lock else ''), (oid,identity)).fetchone()
-        if not row: raise HTTPException(404, 'Order not found')
-        return row
-
-    def file_rows(c, oid):
-        return c.execute('''SELECT f.id,f.upload_id,f.item_index,f.kind,f.active,f.note,f.created_at,
-            u.name,u.size,u.expires_at,(u.expires_at<=now()) AS expired
-            FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id
-            WHERE order_id=%s ORDER BY f.created_at''', (oid,)).fetchall()
-
-    @app.get('/api/customer/orders')
-    def orders(identity=Depends(owner)):
-        with db.connect() as c:
-            rows = c.execute('SELECT id,number,state,version,snapshot,created_at,updated_at FROM dtf_local.orders WHERE owner=%s ORDER BY created_at DESC', (identity,)).fetchall()
-            quotes = c.execute('''SELECT q.id,q.approved,q.approved_at,q.created_at FROM dtf_local.quotes q
-                LEFT JOIN dtf_local.orders o ON o.quote_id=q.id WHERE q.owner=%s AND o.id IS NULL ORDER BY q.created_at DESC''', (identity,)).fetchall()
-        return {'orders': rows, 'quotes': quotes, 'states': states}
-
-    @app.get('/api/customer/orders/{oid}')
-    def detail(oid: UUID, identity=Depends(owner)):
-        with db.connect() as c:
-            row = owned_order(c, oid, identity)
-            history = c.execute('SELECT from_state,to_state,reason,created_at FROM dtf_local.movements WHERE order_id=%s ORDER BY id', (oid,)).fetchall()
-            return {'id': row['id'], 'number': row['number'], 'state': row['state'], 'version': row['version'],
-                    'snapshot': row['snapshot'], 'history': history, 'files': file_rows(c,oid)}
-
-    def submit_files(c, order, body, identity, kind, actor):
-        if order['version'] != body.version:
-            raise HTTPException(409, 'Order changed. Refresh before submitting files.')
-        if kind == 'final' and order['state'] not in ('rec','tra','cor'):
-            raise HTTPException(409, 'Final files can only change during artwork review')
-        if kind == 'correction' and order['state'] != 'cor':
-            raise HTTPException(409, 'This order is not awaiting artwork correction')
-        if len({f.upload_id for f in body.files}) != len(body.files):
-            raise HTTPException(422, 'Each uploaded file must appear once')
-        count = len(order['snapshot']['items'])
-        if any(f.item_index >= count for f in body.files):
-            raise HTTPException(422, 'Invalid order item')
-        if kind == 'final' and {f.item_index for f in body.files} != set(range(count)):
-            raise HTTPException(422, 'Final-file set must cover every order item')
-        original_ids = [UUID(uid) for item in order['snapshot']['items'] for uid in item['uploads']]
-        first = c.execute('SELECT min(created_at) AS first FROM dtf_local.uploads WHERE id=ANY(%s)', (original_ids,)).fetchone()['first']
-        expiry = first + timedelta(days=30)
-        if expiry <= datetime.now(timezone.utc):
-            raise HTTPException(410, 'Order artwork retention has expired')
-        for ref in body.files:
-            upload = upload_row(c, ref.upload_id, identity, lock=True)
-            if not upload['complete']:
-                raise HTTPException(409, 'Complete all uploads first')
-            require_clean(upload)
-            if c.execute('SELECT id FROM dtf_local.order_files WHERE upload_id=%s', (ref.upload_id,)).fetchone():
-                raise HTTPException(409, 'File is already attached. Upload a new revision.')
-        c.execute('UPDATE dtf_local.order_files SET active=false WHERE order_id=%s AND kind=%s', (order['id'],kind))
-        for ref in body.files:
-            c.execute('INSERT INTO dtf_local.order_files(id,order_id,upload_id,item_index,kind,note,created_by) VALUES(%s,%s,%s,%s,%s,%s,%s)',
-                      (uuid4(),order['id'],ref.upload_id,ref.item_index,kind,body.note,actor))
-            c.execute('UPDATE dtf_local.uploads SET expires_at=LEAST(expires_at,%s) WHERE id=%s', (expiry,ref.upload_id))
-        c.execute('UPDATE dtf_local.orders SET version=version+1,updated_at=now() WHERE id=%s', (order['id'],))
-        if kind == 'final':
-            # Artwork approval, not commercial quote approval, starts original cleanup.
-            c.execute("UPDATE dtf_local.uploads SET expires_at=LEAST(expires_at,now()+interval '7 days') WHERE id=ANY(%s)", (original_ids,))
-        return {'ok': True, 'version': order['version']+1, 'expires_at': expiry}
-
-    @app.post('/api/customer/orders/{oid}/corrections')
-    def correction(oid: UUID, body: ArtworkSubmission, identity=Depends(owner)):
-        with db.connect() as c:
-            order = owned_order(c, oid, identity, lock=True)
-            return submit_files(c,order,body,identity,'correction','customer')
-
-    @app.get('/api/customer/orders/{oid}/files/{fid}/download')
-    def customer_download(oid: UUID, fid: UUID, identity=Depends(owner)):
-        with db.connect() as c:
-            owned_order(c,oid,identity)
-            row = c.execute('SELECT u.* FROM dtf_local.order_files f JOIN dtf_local.uploads u ON u.id=f.upload_id WHERE f.id=%s AND f.order_id=%s AND f.active', (fid,oid)).fetchone()
-            if not row: raise HTTPException(404, 'Active file not found')
-            if row['expires_at'] <= datetime.now(timezone.utc): raise HTTPException(410, 'File expired')
-            require_clean(row)
-        return {'url':storage.download(row['object_key'],row['name']), 'name':row['name']}
-
-    def operator_identity(user):
-        return uuid5(NAMESPACE_URL, 'dtf-local-operator:'+user)
-
-    @app.post('/api/operator/orders/{oid}/uploads')
-    def begin_final(oid: UUID, body: UploadStart, user=Depends(operator)):
-        with db.connect() as c:
-            row = c.execute('SELECT state FROM dtf_local.orders WHERE id=%s', (oid,)).fetchone()
-            if not row: raise HTTPException(404, 'Order not found')
-            if row['state'] not in ('rec','tra','cor'): raise HTTPException(409, 'Order is not in artwork review')
-        return begin(body, session_id=operator_identity(user))
-
-    @app.get('/api/operator/uploads/{uid}')
-    def final_status(uid: UUID, user=Depends(operator)):
-        return status(uid,session_id=operator_identity(user))
-
-    @app.post('/api/operator/uploads/{uid}/parts/{number}')
-    def final_part(uid: UUID, number: int, user=Depends(operator)):
-        return part(uid,number,session_id=operator_identity(user))
-
-    @app.post('/api/operator/uploads/{uid}/complete')
-    def final_complete(uid: UUID, user=Depends(operator)):
-        return complete(uid,session_id=operator_identity(user))
-
-    @app.get('/api/operator/orders/{oid}/files')
-    def operator_files(oid: UUID, user=Depends(operator)):
-        with db.connect() as c:
-            return file_rows(c,oid)
-
-    @app.post('/api/operator/orders/{oid}/final-files')
-    def final_files(oid: UUID, body: ArtworkSubmission, user=Depends(operator)):
-        with db.connect() as c:
-            order = c.execute('SELECT * FROM dtf_local.orders WHERE id=%s FOR UPDATE', (oid,)).fetchone()
-            if not order: raise HTTPException(404, 'Order not found')
-            return submit_files(c,order,body,operator_identity(user),'final',user)
--- a/ops/init.py
+++ b/ops/init.py
@@ -0,0 +1 @@
+"""Operational commands: backup, readiness, audit, security summary."""
--- a/local/backup.py
+++ b/local/backup.py
--- a/local/dependency_audit.py
+++ b/local/dependency_audit.py
--- a/local/security_status.py
+++ b/local/security_status.py
@@ -1,8 +1,8 @@
 """Local alert triage: prints redacted counts; exits 1 when attention is required."""
 import json
 from datetime import datetime, timezone
-from .db import connect
-from .scanning import ClamAV
+from app.core.db import connect
+from app.scanning import ClamAV

 def scanner_status():
    try:
--- a/local/staging_readiness.py
+++ b/local/staging_readiness.py
--- a/local/storage_backup.py
+++ b/local/storage_backup.py
@@ -8,8 +8,8 @@ import tarfile
 from datetime import datetime, timezone
 from uuid import uuid4

-from .adapters import LocalS3Storage, require_local
-from .db import connect
+from app.adapters import LocalS3Storage, require_local
+from app.core.db import connect

 CHUNK = 8 * 1024 * 1024
 MAX_OBJECT = min(128 * 1024 * 1024, int(os.environ.get('SCAN_MAX_BYTES', '134217728')))
--- a/tests/init.py
+++ b/tests/init.py
@@ -0,0 +1 @@
+"""Test suites. Not shipped in the production image."""
--- a/tests/artwork_browser_test.mjs
+++ b/tests/artwork_browser_test.mjs
@@ -9,7 +9,7 @@ import {mkdtemp, readFile, writeFile, mkdir} from 'node:fs/promises';
 import {tmpdir} from 'node:os';
 import {resolve} from 'node:path';

-const html=await readFile('dtf-site.html','utf8');
+const html=await readFile('web/index.html','utf8');
 const hashes=[...html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/gi)]
  .filter(m=>! /\bsrc\s*=/i.test(m[1]))
  .map(m=>"'sha256-"+createHash('sha256').update(m[2]).digest('base64')+"'");
@@ -24,12 +24,12 @@ const server=createServer(async(req,res)=>{
    res.setHeader('Content-Security-Policy',`default-src 'self'; script-src 'self' ${hashes.join(' ')}; script-src-attr 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; object-src 'none'`);
    res.end(html);return;
  }
-  // Serve any script the page asks for, resolved inside local/static, rather than
+  // Serve any script the page asks for, resolved inside web/, rather than
  // a hardcoded list: the Site's behaviour is split across several files and a
  // list would silently 404 the next one added.
  if(/^\/[\w.-]+\.js$/.test(req.url)){
    try{
-      const body=await readFile(resolve('local/static'+req.url));
+      const body=await readFile(resolve('web'+req.url));
      res.setHeader('Content-Type','text/javascript');res.end(body);return;
    }catch{ res.writeHead(404);res.end();return; }
  }
--- a/tests/browser_test.mjs
+++ b/tests/browser_test.mjs
@@ -59,7 +59,7 @@ try{
  await site.click('[data-cam="tabela"]');
  const root=await site.call('DOM.getDocument');
  const input=await site.call('DOM.querySelector',{nodeId:root.root.nodeId,selector:'#inp'});
-  await site.call('DOM.setFileInputFiles',{nodeId:input.nodeId,files:[resolve('local/fixtures/local-test.cdr')]});
+  await site.call('DOM.setFileInputFiles',{nodeId:input.nodeId,files:[resolve('tests/fixtures/local-test.cdr')]});
  await waitFor(()=>site.eval('!!document.querySelector("[data-comp]")'),'manual length field');
  await site.fill('[data-comp]','1.01','change');
  await waitFor(()=>site.eval('!!itemAtual'),'cart calculation');
@@ -99,7 +99,7 @@ try{
      await waitFor(()=>kanban.eval(`!!document.querySelector('[data-order="${oid}"] [data-final-item]')`),'final upload controls');
      const doc=await kanban.call('DOM.getDocument');
      const input=await kanban.call('DOM.querySelector',{nodeId:doc.root.nodeId,selector:`[data-order="${oid}"] [data-final-item]`});
-      await kanban.call('DOM.setFileInputFiles',{nodeId:input.nodeId,files:[resolve('local/fixtures/local-test.cdr')]});
+      await kanban.call('DOM.setFileInputFiles',{nodeId:input.nodeId,files:[resolve('tests/fixtures/local-test.cdr')]});
      await kanban.fill(`[data-order="${oid}"] input[placeholder="Nota da revisão"]`,'Browser test final file');
      await kanban.eval(`(()=>{const form=document.querySelector('[data-order="${oid}"] form');form.querySelector('[type=checkbox]').click();form.requestSubmit();})()`);
      await waitFor(()=>kanban.eval(`board.orders.find(o=>o.id==='${oid}').version===2`),'final file approval');
--- a/tests/fixtures/local-test.cdr
+++ b/tests/fixtures/local-test.cdr
--- a/tests/retention_test.py
+++ b/tests/retention_test.py
@@ -2,9 +2,9 @@
 from datetime import datetime, timedelta, timezone
 from uuid import uuid4
 from botocore.exceptions import ClientError
-from .adapters import LocalS3Storage
-from .db import connect
-from .worker import cleanup
+from app.adapters import LocalS3Storage
+from app.core.db import connect
+from app.worker import cleanup

 def run():
    storage=LocalS3Storage()
--- a/tests/runtime_security_test.py
+++ b/tests/runtime_security_test.py
@@ -2,10 +2,10 @@
 import hashlib
 from unittest.mock import patch
 from botocore.exceptions import ClientError
-from .db import connect
-from .adapters import LocalS3Storage
-from .auth import client_ip, password_hash, password_matches
-from .scanning import ClamAV, require_clean
+from app.core.db import connect
+from app.adapters import LocalS3Storage
+from app.core.auth import client_ip, password_hash, password_matches
+from app.scanning import ClamAV, require_clean
 from fastapi import HTTPException

 class FakeRequest:
@@ -29,8 +29,8 @@ def check_client_ip():
 def check_operator_accounts():
    """Accounts are per person, and disabling one ends its access at once."""
    from uuid import uuid4
-    from .auth import password_hash, password_matches
-    from .operators import seed_from_environment, set_active
+    from app.core.auth import password_hash, password_matches
+    from app.operators import seed_from_environment, set_active
    email='runtime-check-'+uuid4().hex[:8]+'@example.test'
    with connect() as c:
        c.execute('INSERT INTO dtf_local.operators(id,email,name,password_hash) VALUES(%s,%s,%s,%s)',
@@ -79,7 +79,7 @@ def run():
    require_clean({'complete':True,'scan_state':'clean'})
    assert ClamAV().ping() and ClamAV().version().startswith('ClamAV ')
    assert ClamAV().scan(None,134217729)[0]=='rejected'
-    with patch('local.scanning.socket.create_connection',side_effect=OSError('offline')):
+    with patch('app.scanning.socket.create_connection',side_effect=OSError('offline')):
        try:ClamAV().scan(None,1);raise AssertionError('Offline scanner returned success')
        except OSError:pass
    print('PASS: runtime DB/S3 least privilege, legacy/current password hashes, quarantine states and scanner size/offline behavior')
--- a/tests/scanning_test.py
+++ b/tests/scanning_test.py
@@ -1,6 +1,6 @@
 """Harmless EICAR anti-malware test and blocked download/quote regressions."""
 from uuid import uuid4
-from .smoke_test import Client, upload_bytes
+from tests.smoke_test import Client, upload_bytes

 def run():
    customer=Client();customer.call('/session')
--- a/tests/security_test.py
+++ b/tests/security_test.py
@@ -5,7 +5,7 @@ from urllib.error import HTTPError
 from urllib.request import Request, urlopen
 from urllib.parse import urlparse, parse_qs
 from uuid import uuid4
-from .smoke_test import Client, BASE, with_host
+from tests.smoke_test import Client, BASE, with_host

 def raw(path, expected, headers=None, body=None):
    request=Request(BASE+path, data=body, headers=with_host(headers))
--- a/tests/smoke_test.py
+++ b/tests/smoke_test.py
@@ -1,6 +1,6 @@
 """Local stack integration checks; creates and retains clearly named test orders.

-Run: python3 -m local.smoke_test. Standard library only. Honors .env/environment.
+Run: python3 -m tests.smoke_test. Standard library only. Honors .env/environment.
 """
 from concurrent.futures import ThreadPoolExecutor
 import hashlib
--- a/tests/test_dependency_lock.py
+++ b/tests/test_dependency_lock.py
@@ -13,8 +13,8 @@ def normalized(name):
 class DependencyLockTests(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
-        cls.direct_text = (ROOT / 'local/requirements.txt').read_text()
-        cls.lock_text = (ROOT / 'local/requirements.lock').read_text()
+        cls.direct_text = (ROOT / 'infra/requirements.txt').read_text()
+        cls.lock_text = (ROOT / 'infra/requirements.lock').read_text()

    def test_every_direct_pin_matches_lock(self):
        direct = {normalized(name): version for name, version in
@@ -34,9 +34,9 @@ class DependencyLockTests(unittest.TestCase):
            self.assertTrue(hashes, f'{match.group(1)} has no SHA-256 artifact hash')

    def test_image_build_requires_the_lock_and_hashes(self):
-        dockerfile = (ROOT / 'local/Dockerfile').read_text()
+        dockerfile = (ROOT / 'infra/Dockerfile').read_text()
        self.assertIn('requirements.lock', dockerfile)
-        self.assertIn('--require-hashes -r local/requirements.lock', dockerfile)
+        self.assertIn('--require-hashes -r infra/requirements.lock', dockerfile)

    def test_reproducible_generator_is_recorded(self):
        self.assertIn('./local/lock_dependencies.sh', self.lock_text[:300])
--- a/tests/test_pricing.py
+++ b/tests/test_pricing.py
@@ -1,15 +1,15 @@
-"""Run from repository root: python3 -m unittest local.test_pricing -v."""
+"""Run from repository root: python3 -m unittest tests.test_pricing -v."""
 import json
 from pathlib import Path
 import subprocess
 import unittest
-from .pricing import price, TIERS
+from app.core.pricing import price, TIERS

 class PricingTests(unittest.TestCase):
    def test_every_grade_against_actual_site_javascript(self):
        # The ladders live with the rest of the Site's behaviour; this test exists
        # to prove the server agrees with whatever the customer is shown.
-        source = Path('local/static/site-config.js').read_text()
+        source = Path('web/site-config.js').read_text()
        tiers = source.split('const FAIXAS=')[1].split('\n};',1)[0]+'\n}'
        calculator = source.split('const cobrar=')[1].split(';',1)[0]
        js = f'const FAIXAS={tiers};const MINIMO_M=1;const cobrar={calculator};'
--- a/tests/test_secrets.py
+++ b/tests/test_secrets.py
@@ -3,7 +3,7 @@ import tempfile
 import unittest
 from pathlib import Path

-from local.secrets import SECRET_FILE_SETTINGS, load, read_secret
+from app.core.secrets import SECRET_FILE_SETTINGS, load, read_secret


 class SecretFileTests(unittest.TestCase):
--- a/tests/test_staging_readiness.py
+++ b/tests/test_staging_readiness.py
@@ -2,7 +2,7 @@ import tempfile
 import unittest
 from pathlib import Path

-from .staging_readiness import read_config, validate
+from ops.staging_readiness import read_config, validate


 VALID = '''
--- a/tests/workflow_test.py
+++ b/tests/workflow_test.py
@@ -1,7 +1,7 @@
 """Customer identity, correction and final-file trust boundaries against local stack."""
 from uuid import uuid4
 from urllib.request import urlopen
-from .smoke_test import Client, upload_bytes
+from tests.smoke_test import Client, upload_bytes

 def run():
    customer=Client();other=Client();customer.call('/session');other.call('/session')
--- a/local/static/cart.js
+++ b/local/static/cart.js
--- a/local/static/checkout.js
+++ b/local/static/checkout.js
@@ -1,4 +1,4 @@
-/* Checkout bridge only: approved commercial functions in dtf-site.html stay intact. */
+/* Checkout bridge only: approved commercial functions in web/index.html stay intact. */
 (() => {
  const status = document.getElementById('checkoutStatus');
  const actions = document.getElementById('checkoutActions');
--- a/web/index.html
+++ b/web/index.html
--- a/local/static/kanban.html
+++ b/local/static/kanban.html
--- a/local/static/kanban.js
+++ b/local/static/kanban.js
--- a/local/static/portal.html
+++ b/local/static/portal.html
--- a/local/static/portal.js
+++ b/local/static/portal.js
--- a/local/static/privacy.js
+++ b/local/static/privacy.js
--- a/local/static/site-cart.js
+++ b/local/static/site-cart.js
@@ -1,5 +1,5 @@
 /* Site DTF — Cart totals and the order summary.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── carrinho
--- a/local/static/site-config.js
+++ b/local/static/site-config.js
@@ -1,5 +1,5 @@
 /* Site DTF — Product tables, commercial ladders, shared state and field validation.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */

--- a/local/static/site-flow.js
+++ b/local/static/site-flow.js
@@ -1,5 +1,5 @@
 /* Site DTF — Carousel, path selector, delivery choice and input masks.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── decisões
--- a/local/static/site-modes.js
+++ b/local/static/site-modes.js
@@ -1,5 +1,5 @@
 /* Site DTF — Choosing a product, and the declared sheet/loose-artwork switch.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── escolha
--- a/local/static/site-packing.js
+++ b/local/static/site-packing.js
@@ -1,5 +1,5 @@
 /* Site DTF — Masks, the nesting engine, and drawing the assembled film.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── imagens e prévia
--- a/local/static/site-pdf.js
+++ b/local/static/site-pdf.js
@@ -1,12 +1,12 @@
 /* Site DTF — PDF measurement and rasterisation, and the DPI of images inside one.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── PDF também é conferido: rasteriza a página e mede o DPI das imagens de dentro.
 // Arte vetorial não tem resolução — nesses casos a nota é máxima, e isso é correto.
 // Served from this origin, not a CDN: the Site keeps working when a third party
 // does not, and the CSP can name only 'self' for scripts and workers. Provenance
-// and hashes are recorded in local/static/vendor/README.md.
+// and hashes are recorded in web/vendor/README.md.
 const PDFJS_URL='/vendor/pdf.min.js';
 const PDFJS_WORKER=new URL('/vendor/pdf.worker.min.js', location.origin).href;
 let pdfLibP=null, temWorker=null;
--- a/local/static/site-quality.js
+++ b/local/static/site-quality.js
@@ -1,5 +1,5 @@
 /* Site DTF — The grade shown to the customer, and the reservations attached to it.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── enviar
--- a/local/static/site-sheet.js
+++ b/local/static/site-sheet.js
@@ -1,5 +1,5 @@
 /* Site DTF — Reading a finished sheet from its alpha channel: pieces, gaps, waste.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── Análise real da folha: lê o canal alfa, separa cada ilha de arte e mede.
--- a/local/static/site-upload.js
+++ b/local/static/site-upload.js
@@ -1,5 +1,5 @@
 /* Site DTF — Accepting files: the drop zone, the accept rules, first measurement.
-   Extracted verbatim from the single inline script in dtf-site.html.
+   Extracted verbatim from the single inline script in web/index.html.
   Loaded as classic scripts in the order listed there: they share one global
   scope and run top to bottom, exactly as the original did. */
 // ── upload
--- a/local/static/upload.js
+++ b/local/static/upload.js
--- a/local/static/vendor/README.md
+++ b/local/static/vendor/README.md
@@ -28,6 +28,6 @@ curl -s "https://api.cdnjs.com/libraries/pdf.js/<version>?fields=sri"
 ```

 **Version note.** 3.11.174 is old. It is affected by GHSA-wgrm-67xf-hhpq, whose
-documented workaround is `isEvalSupported: false`; `dtf-site.html` already passes
+documented workaround is `isEvalSupported: false`; `web/index.html` already passes
 that, so the known path is closed. Upgrading is worthwhile but is an API change,
 not a file swap, and belongs with its own browser testing — see `ROADMAP.md` 2.7.
--- a/local/static/vendor/pdf.min.js
+++ b/local/static/vendor/pdf.min.js
--- a/local/static/vendor/pdf.worker.min.js
+++ b/local/static/vendor/pdf.worker.min.js
				`@@ -0,0 +1 @@`
				`"""Shared foundations: identity, database, models, prices, secret loading."""`
				`@@ -0,0 +1 @@`
				`"""Operational commands: backup, readiness, audit, security summary."""`
				`@@ -0,0 +1 @@`
				`"""Test suites. Not shipped in the production image."""`