Rebuild Inertia SSR assets after the upload and artwork UI changes.

Replace hashed SSR bundles so server-rendered pages match the current frontend.

.env.example

@@ -4,6 +4,23 @@ APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost
 
+# Maximum secondary artwork categories in addition to the primary category.
+CATEGORIES_MAX_SECONDARY=5
+
+# Artwork original downloads: PHP fallback unless nginx X-Accel is configured.
+# Leave false until the internal location exists and has been verified.
+DOWNLOAD_ACCEL_ENABLED=false
+DOWNLOAD_ACCEL_PATH=/internal/originals
+
+SECURITY_REPORT_ENABLED=true
+SECURITY_REPORT_NOTIFY_EMAIL=
+SECURITY_REPORT_SCAN_NPM=true
+SECURITY_REPORT_SCAN_COMPOSER=true
+SECURITY_REPORT_STORE_RAW=true
+SECURITY_REPORT_MAX_RAW_KB=512
+SECURITY_REPORT_FAIL_ON_HIGH=false
+SECURITY_REPORT_FAIL_ON_CRITICAL=false
+
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
 APP_FAKER_LOCALE=en_US
@@ -20,6 +37,11 @@ LOG_STACK=single
 LOG_DEPRECATIONS_CHANNEL=null
 LOG_LEVEL=debug
 
+# M12 — slow Laravel HTTP log (threshold only; disable for zero overhead)
+HTTP_SLOW_REQUEST_LOG_ENABLED=false
+HTTP_SLOW_REQUEST_MS=750
+HTTP_SLOW_REQUEST_LOG_DAYS=14
+
 DB_CONNECTION=mysql
 DB_HOST=127.0.0.1
 DB_PORT=3306
@@ -53,6 +75,48 @@ BROADCAST_CONNECTION=reverb
 FILESYSTEM_DISK=local
 QUEUE_CONNECTION=redis
 
+# Comment spam protection: observe records scores without changing visibility.
+COMMENT_SPAM_ENABLED=true
+COMMENT_SPAM_MODE=enforce
+COMMENT_SPAM_AI_ENABLED=true
+COMMENT_SPAM_AI_PROVIDER=together
+# Supported: Prism-ML/Ternary-Bonsai-27B or meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_MODEL=meta-llama/Llama-3.2-3B-Instruct-Turbo
+COMMENT_SPAM_AI_TIMEOUT=5
+TOGETHER_API_KEY=
+TOGETHER_API_BASE_URL=https://api.together.xyz/v1
+COMMENT_SPAM_LOCAL_SAFE_MAX=29
+COMMENT_SPAM_LOCAL_SPAM_MIN=70
+COMMENT_SPAM_AI_SPAM_MIN=70
+COMMENT_SPAM_SIGNATURE_CACHE_MINUTES=1440
+COMMENT_TURNSTILE_ENABLED=false
+COMMENT_TURNSTILE_SITE_KEY=
+COMMENT_TURNSTILE_SECRET_KEY=
+COMMENT_TURNSTILE_RISK_THRESHOLD=40
+COMMENT_TURNSTILE_FAIL_OPEN=false
+# Must exceed Horizon supervisor-default timeout (960s). Production used 90s
+# and nightly RecComputeSimilar* jobs failed with MaxAttemptsExceeded.
+REDIS_QUEUE_RETRY_AFTER=1080
+
+# Collection maintenance / forum AI jobs have no Horizon consumer.
+# Leave false until a dedicated supervisor exists (M7).
+COLLECTIONS_V5_DISPATCH_ENABLED=false
+FORUM_QUEUE_DISPATCH_ENABLED=false
+ONLINE_VISITOR_INDEX_READ_LIMIT=2000
+ONLINE_VISITOR_INDEX_PRUNE_ENABLED=false
+ONLINE_VISITOR_INDEX_PRUNE_SCAN_COUNT=500
+ONLINE_VISITOR_INDEX_PRUNE_MAX_BATCHES=200
+ONLINE_VISITOR_INDEX_PRUNE_SLEEP_MS=25
+# RankBuildScopeListsJob unique lock (seconds). Must exceed queue wait + 300s timeout.
+RANK_SCOPE_JOB_UNIQUE_FOR=21600
+
+# Hourly artwork metric snapshots (heat / rising / monthly leaderboards).
+# Production currently holds ~7 days because the scheduler passed --keep-days=7.
+# Monthly leaderboards and Studio 30d views need 30 days of hourly history.
+ARTWORK_METRIC_HOURLY_RETENTION_DAYS=30
+ARTWORK_METRIC_HOURLY_PRUNE_CHUNK=5000
+ARTWORK_METRIC_HOURLY_PRUNE_SLEEP_MS=50
+
 MESSAGING_REALTIME=true
 MESSAGING_BROADCAST_QUEUE=broadcasts
 MESSAGING_TYPING_TTL=8
@@ -92,6 +156,13 @@ UPLOAD_CHUNK_REQUEST_TIMEOUT_MS=45000
 UPLOAD_RATE_CHUNK_USER=180
 UPLOAD_RATE_CHUNK_IP=360
 
+# New accounts without this many moderator/legacy published artworks go to review.
+# Queued uploads and trusted_auto publishes do not count, so a new user's 6th upload stays hidden.
+UPLOAD_MIN_APPROVED_UPLOADS=5
+UPLOAD_MIN_ACCOUNT_AGE_DAYS=7
+UPLOAD_MAX_UNTRUSTED_LEVEL=1
+UPLOAD_BOT_RISK_REVIEW_THRESHOLD=40
+
 # Draft abuse prevention controls
 SKINBASE_MAX_DRAFTS=10
 SKINBASE_MAX_DRAFT_STORAGE_MB=1024
@@ -114,6 +185,11 @@ VISION_VECTOR_GATEWAY_RETRIES=1
 VISION_VECTOR_GATEWAY_RETRY_DELAY_MS=250
 VISION_VECTOR_GATEWAY_UPSERT_ENDPOINT=/vectors/upsert
 VISION_VECTOR_GATEWAY_SEARCH_ENDPOINT=/vectors/search
+VISION_VECTOR_GATEWAY_SEARCH_FILE_ENDPOINT=/vectors/search/file
+VISION_VECTOR_GATEWAY_SEARCH_TIMEOUT=6
+VISION_VECTOR_GATEWAY_SEARCH_CONNECT_TIMEOUT=2
+VISION_VECTOR_GATEWAY_SEARCH_RETRIES=0
+VISION_VECTOR_GATEWAY_CIRCUIT_SECONDS=30
 VISION_VECTOR_GATEWAY_DELETE_ENDPOINT=/vectors/delete
 VISION_VECTOR_GATEWAY_COLLECTIONS_ENDPOINT=/vectors/collections
 
@@ -210,6 +286,25 @@ YOLO_HTTP_RETRIES=1
 YOLO_HTTP_RETRY_DELAY_MS=200
 YOLO_PHOTOGRAPHY_ONLY=true
 
+# Academy feature flags
+SKINBASE_ACADEMY_ENABLED=true
+SKINBASE_ACADEMY_PAYMENTS_ENABLED=false
+ACADEMY_BILLING_ENABLED=false
+ACADEMY_STRIPE_SUBSCRIPTION_NAME=academy
+
+# Stripe / Cashier
+STRIPE_KEY=pk_test_xxx
+STRIPE_SECRET=sk_test_xxx
+STRIPE_WEBHOOK_SECRET=whsec_xxx
+CASHIER_CURRENCY=eur
+CASHIER_CURRENCY_LOCALE=sl_SI
+
+# Academy billing price IDs
+ACADEMY_CREATOR_MONTHLY_PRICE_ID=price_xxx
+ACADEMY_PRO_MONTHLY_PRICE_ID=price_xxx
+
+# Stripe expects real price object IDs that start with price_, not product IDs like prod_...
+
 # -----------------------------------------------------------------------------
 # Production examples (uncomment and adjust)
 # -----------------------------------------------------------------------------
@@ -310,6 +405,30 @@ TURNSTILE_FAIL_OPEN=false
 TURNSTILE_VERIFY_URL=https://challenges.cloudflare.com/turnstile/v0/siteverify
 TURNSTILE_TIMEOUT=5
 
+ENHANCE_DISK=public
+ENHANCE_SOURCE_PREFIX=enhance/sources
+ENHANCE_OUTPUT_PREFIX=enhance/outputs
+ENHANCE_PREVIEW_PREFIX=enhance/previews
+ENHANCE_ENGINE=stub
+ENHANCE_MAX_UPLOAD_MB=20
+ENHANCE_MAX_INPUT_WIDTH=4096
+ENHANCE_MAX_INPUT_HEIGHT=4096
+ENHANCE_MAX_OUTPUT_WIDTH=8192
+ENHANCE_MAX_OUTPUT_HEIGHT=8192
+ENHANCE_DAILY_LIMIT=10
+ENHANCE_QUEUE=default
+ENHANCE_COMPLETED_EXPIRES_AFTER_DAYS=30
+ENHANCE_FAILED_EXPIRES_AFTER_DAYS=7
+ENHANCE_DELETED_FILE_GRACE_DAYS=1
+ENHANCE_CLEANUP_CHUNK_SIZE=100
+ENHANCE_STUCK_PROCESSING_AFTER_MINUTES=30
+ENHANCE_STUCK_QUEUED_AFTER_MINUTES=60
+ENHANCE_STUB_SHOW_WARNING=true
+ENHANCE_WORKER_URL=
+ENHANCE_WORKER_TIMEOUT=300
+ENHANCE_WORKER_TOKEN=
+ENHANCE_WORKER_MAX_DOWNLOAD_MB=60
+
 AWS_ACCESS_KEY_ID=
 AWS_SECRET_ACCESS_KEY=
 AWS_DEFAULT_REGION=us-east-1
@@ -356,6 +475,19 @@ GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 GOOGLE_REDIRECT_URI=/auth/google/callback
 
+# Google AdSense Management API (admin analytics, read-only)
+# Redirect URI must match the Google Cloud OAuth client exactly.
+ADSENSE_CLIENT_ID=
+ADSENSE_CLIENT_SECRET=
+ADSENSE_REDIRECT_URI=https://skinbase.org/admin/adsense/oauth/callback
+ADSENSE_SYNC_ENABLED=true
+
+# Optional light theme feature
+# Set LIGHT_THEME_ENABLED=true to allow a light theme in the client-side toggle.
+# Set LIGHT_THEME_SHOW_SWITCH=true to display the theme switch in the toolbar.
+LIGHT_THEME_ENABLED=false
+LIGHT_THEME_SHOW_SWITCH=false
+
 # Discord — https://discord.com/developers/applications
 DISCORD_CLIENT_ID=
 DISCORD_CLIENT_SECRET=

.gitignore

@@ -13,6 +13,7 @@
 /.deploy
 /.zed
 /auth.json
+/build-info.json
 /node_modules
 /public/build
 /public/hot
@@ -45,6 +46,7 @@
 /storage/*.tar.xz
 /storage/*.tar
 /storage/*.tgz
+/var/deploy/
 /vendor
 Homestead.json
 Homestead.yaml

app/Console/Commands/AcademyAnalyticsHealthCommand.php

@@ -0,0 +1,183 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AcademyContentMetricDaily;
+use App\Models\AcademyEvent;
+use App\Models\AcademyLike;
+use App\Models\AcademySave;
+use App\Models\AcademySearchLog;
+use App\Models\AcademyUserProgress;
+use App\Support\AcademyAnalytics\AcademyAnalyticsEventType;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Schema;
+
+final class AcademyAnalyticsHealthCommand extends Command
+{
+    protected $signature = 'academy:analytics-health {--json : Output machine-readable JSON}';
+
+    protected $description = 'Inspect Academy analytics collection health, rollup freshness, and privacy safeguards';
+
+    private const RETENTION_DAYS = 180;
+
+    public function handle(): int
+    {
+        $report = $this->buildReport();
+
+        if ((bool) $this->option('json')) {
+            $this->line(json_encode($report, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) ?: '{}');
+
+            return self::SUCCESS;
+        }
+
+        $this->line('Academy Analytics Health Check');
+        $this->line('==============================');
+        $this->newLine();
+        $this->line(sprintf('Events last 24h: %d', $report['events_last_24h']));
+        $this->line(sprintf('Events last 7d: %d', $report['events_last_7d']));
+        $this->line(sprintf('Latest event: %s', $report['latest_event_at'] ?? 'none'));
+        $this->line(sprintf('Latest rollup date: %s', $report['latest_rollup_date'] ?? 'none'));
+        $this->line(sprintf('Search logs: %d', $report['search_logs']));
+        $this->line(sprintf('Search clicks: %d', $report['search_clicks']));
+        $this->line(sprintf('Likes: %d', $report['likes']));
+        $this->line(sprintf('Saves: %d', $report['saves']));
+        $this->line(sprintf('Progress records: %d', $report['progress_records']));
+        $this->line(sprintf('Prompt copies: %d', $report['prompt_copies']));
+        $this->line(sprintf('Upgrade clicks: %d', $report['upgrade_clicks']));
+        $this->line(sprintf('Human events: %d', $report['human_events']));
+        $this->line(sprintf('Bot/admin events: %d', $report['bot_admin_events']));
+        $this->line(sprintf('Recent daily metric rows: %d', $report['recent_daily_metric_rows']));
+        $this->line(sprintf('Raw IP storage detected: %s', $report['raw_ip_storage_detected'] ? 'yes' : 'no'));
+        $this->line(sprintf('Events older than retention: %d', $report['events_older_than_retention']));
+        $this->newLine();
+
+        foreach ($report['warnings'] as $warning) {
+            $this->warn(sprintf('WARNING: %s', $warning));
+        }
+
+        $this->info(sprintf('Status: %s', $report['status']));
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function buildReport(): array
+    {
+        $now = now();
+        $last24Hours = $now->copy()->subDay();
+        $last7Days = $now->copy()->subDays(7);
+        $retentionCutoff = $now->copy()->subDays(self::RETENTION_DAYS);
+        $warnings = [];
+        $rawIpStorageDetected = $this->rawIpStorageDetected();
+        $eventsTableExists = Schema::hasTable('academy_events');
+        $metricsTableExists = Schema::hasTable('academy_content_metrics_daily');
+        $searchLogsTableExists = Schema::hasTable('academy_search_logs');
+        $likesTableExists = Schema::hasTable('academy_likes');
+        $savesTableExists = Schema::hasTable('academy_saves');
+        $progressTableExists = Schema::hasTable('academy_user_progress');
+
+        $latestEvent = $eventsTableExists ? AcademyEvent::query()->latest('occurred_at')->value('occurred_at') : null;
+        $latestRollup = $metricsTableExists ? AcademyContentMetricDaily::query()->latest('date')->value('date') : null;
+        $searchLogCount = $searchLogsTableExists ? AcademySearchLog::query()->count() : 0;
+        $searchClickCount = $searchLogsTableExists ? AcademySearchLog::query()->whereNotNull('clicked_content_id')->count() : 0;
+        $eventsOlderThanRetention = $eventsTableExists ? AcademyEvent::query()->where('occurred_at', '<', $retentionCutoff)->count() : 0;
+        $recentDailyMetricRows = $metricsTableExists
+            ? AcademyContentMetricDaily::query()->whereBetween('date', [$now->copy()->subDays(6)->toDateString(), $now->toDateString()])->count()
+            : 0;
+
+        $report = [
+            'events_last_24h' => $eventsTableExists ? AcademyEvent::query()->where('occurred_at', '>=', $last24Hours)->count() : 0,
+            'events_last_7d' => $eventsTableExists ? AcademyEvent::query()->where('occurred_at', '>=', $last7Days)->count() : 0,
+            'latest_event_at' => $latestEvent ? Carbon::parse((string) $latestEvent)->toDateTimeString() : null,
+            'latest_rollup_date' => $latestRollup ? Carbon::parse((string) $latestRollup)->toDateString() : null,
+            'search_logs' => $searchLogCount,
+            'search_clicks' => $searchClickCount,
+            'likes' => $likesTableExists ? AcademyLike::query()->count() : 0,
+            'saves' => $savesTableExists ? AcademySave::query()->count() : 0,
+            'progress_records' => $progressTableExists ? AcademyUserProgress::query()->count() : 0,
+            'prompt_copies' => $eventsTableExists ? AcademyEvent::query()->where('event_type', AcademyAnalyticsEventType::PROMPT_COPY)->count() : 0,
+            'upgrade_clicks' => $eventsTableExists ? AcademyEvent::query()->where('event_type', AcademyAnalyticsEventType::UPGRADE_CLICK)->count() : 0,
+            'human_events' => $eventsTableExists ? AcademyEvent::query()->where('is_bot', false)->where('is_admin', false)->where('is_suspicious', false)->count() : 0,
+            'bot_admin_events' => $eventsTableExists ? AcademyEvent::query()->where(function ($query): void {
+                $query->where('is_bot', true)->orWhere('is_admin', true)->orWhere('is_suspicious', true);
+            })->count() : 0,
+            'raw_ip_storage_detected' => $rawIpStorageDetected,
+            'events_older_than_retention' => $eventsOlderThanRetention,
+            'recent_daily_metric_rows' => $recentDailyMetricRows,
+            'retention_days' => self::RETENTION_DAYS,
+            'tables_present' => [
+                'academy_events' => $eventsTableExists,
+                'academy_content_metrics_daily' => $metricsTableExists,
+                'academy_search_logs' => $searchLogsTableExists,
+                'academy_likes' => $likesTableExists,
+                'academy_saves' => $savesTableExists,
+                'academy_user_progress' => $progressTableExists,
+            ],
+            'warnings' => [],
+            'status' => 'OK',
+        ];
+
+        foreach ($report['tables_present'] as $table => $present) {
+            if (! $present) {
+                $warnings[] = sprintf('Analytics table %s is missing.', $table);
+            }
+        }
+
+        if ($report['events_last_24h'] === 0) {
+            $warnings[] = 'No events received in last 24 hours.';
+        }
+
+        if ($report['events_last_7d'] === 0) {
+            $warnings[] = 'No events received in last 7 days.';
+        }
+
+        if ($report['latest_rollup_date'] === null) {
+            $warnings[] = 'No rollup rows exist yet.';
+        } elseif ($report['latest_rollup_date'] !== $now->toDateString()) {
+            $warnings[] = 'Rollup has not run for today.';
+        }
+
+        if ($searchLogCount > 0 && $searchClickCount === 0) {
+            $warnings[] = 'Search clicks are zero although search logs exist.';
+        }
+
+        if ($eventsOlderThanRetention > 0) {
+            $warnings[] = 'Raw events older than configured retention period exist.';
+        }
+
+        if ($recentDailyMetricRows === 0) {
+            $warnings[] = 'No daily metrics exist for recent days.';
+        }
+
+        if ($rawIpStorageDetected) {
+            $warnings[] = 'Raw IP storage indicators were found in Academy analytics tables.';
+        }
+
+        $report['warnings'] = $warnings;
+        $report['status'] = $warnings === [] ? 'OK' : 'WARNING';
+
+        return $report;
+    }
+
+    private function rawIpStorageDetected(): bool
+    {
+        foreach (['academy_events', 'academy_search_logs', 'academy_content_metrics_daily', 'academy_likes', 'academy_saves', 'academy_user_progress'] as $table) {
+            if (! Schema::hasTable($table)) {
+                continue;
+            }
+
+            foreach (['ip', 'ip_address', 'visitor_ip', 'raw_ip', 'remote_addr'] as $column) {
+                if (Schema::hasColumn($table, $column)) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+}

app/Console/Commands/AcademyAnalyticsPruneEventsCommand.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AcademyEvent;
+use Illuminate\Console\Command;
+
+final class AcademyAnalyticsPruneEventsCommand extends Command
+{
+    protected $signature = 'academy:analytics-prune-events {--days=180}';
+
+    protected $description = 'Delete old raw Academy analytics events while keeping daily rollups';
+
+    public function handle(): int
+    {
+        $days = max(1, (int) $this->option('days'));
+        $deleted = AcademyEvent::query()
+            ->where('occurred_at', '<', now()->subDays($days)->startOfDay())
+            ->delete();
+
+        $this->info(sprintf('Pruned %d Academy analytics event(s).', $deleted));
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/AcademyAnalyticsRecalculatePopularityCommand.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AcademyContentMetricDaily;
+use App\Services\Academy\AcademyPopularityService;
+use Illuminate\Console\Command;
+
+final class AcademyAnalyticsRecalculatePopularityCommand extends Command
+{
+    protected $signature = 'academy:analytics-recalculate-popularity {--days=30}';
+
+    protected $description = 'Recalculate Academy daily popularity and conversion scores';
+
+    public function __construct(private readonly AcademyPopularityService $popularity)
+    {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $days = max(1, (int) $this->option('days'));
+
+        AcademyContentMetricDaily::query()
+            ->where('date', '>=', now()->subDays($days - 1)->toDateString())
+            ->chunkById(500, function ($rows): void {
+                foreach ($rows as $row) {
+                    $row->forceFill([
+                        'popularity_score' => $this->popularity->calculatePopularityScore($row->toArray()),
+                        'conversion_score' => $this->popularity->calculateConversionScore($row->toArray()),
+                    ])->save();
+                }
+            });
+
+        $this->info(sprintf('Recalculated Academy popularity for the last %d day(s).', $days));
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/AcademyAnalyticsRollupCommand.php

@@ -0,0 +1,258 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AcademyContentMetricDaily;
+use App\Models\AcademyEvent;
+use App\Models\AcademyLike;
+use App\Models\AcademySave;
+use App\Models\AcademySearchLog;
+use App\Services\Academy\AcademyPopularityService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
+use Carbon\CarbonPeriod;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+
+final class AcademyAnalyticsRollupCommand extends Command
+{
+    protected $signature = 'academy:analytics-rollup {--date=} {--from=} {--to=}';
+
+    protected $description = 'Aggregate Academy analytics raw events and interaction records into daily content metrics';
+
+    public function __construct(private readonly AcademyPopularityService $popularity)
+    {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        [$from, $to] = $this->resolveRange();
+
+        foreach (CarbonPeriod::create($from, $to) as $date) {
+            $this->rollupDate(Carbon::parse($date));
+            $this->line(sprintf('Rolled up Academy analytics for %s.', Carbon::parse($date)->toDateString()));
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function rollupDate(Carbon $date): void
+    {
+        $start = $date->copy()->startOfDay();
+        $end = $date->copy()->endOfDay();
+        $metrics = [];
+        $uniqueVisitors = [];
+        $engagedDurations = [];
+
+        AcademyEvent::query()
+            ->whereBetween('occurred_at', [$start, $end])
+            ->orderBy('id')
+            ->chunkById(1000, function ($events) use (&$metrics, &$uniqueVisitors, &$engagedDurations): void {
+                foreach ($events as $event) {
+                    if ($event->is_bot || $event->is_admin || $event->is_suspicious) {
+                        continue;
+                    }
+
+                    $key = $this->metricKey((string) ($event->content_type ?? ''), $event->content_id ? (int) $event->content_id : null);
+                    $this->ensureMetric($metrics, (string) ($event->content_type ?? ''), $event->content_id ? (int) $event->content_id : null, $key);
+
+                    $visitorKey = $event->user_id ? sprintf('user:%d', (int) $event->user_id) : trim((string) ($event->visitor_id ?? ''));
+                    if ($visitorKey !== '') {
+                        $uniqueVisitors[$key][$visitorKey] = true;
+                    }
+
+                    $eventType = (string) $event->event_type;
+                    if (in_array($eventType, ['academy_page_view', 'academy_content_view', 'academy_lesson_view', 'academy_course_view', 'academy_prompt_pack_view', 'academy_challenge_view'], true)) {
+                        $metrics[$key]['views']++;
+                        if ($event->is_logged_in) {
+                            $metrics[$key]['user_views']++;
+                        } else {
+                            $metrics[$key]['guest_views']++;
+                        }
+                        if ($event->is_subscriber) {
+                            $metrics[$key]['subscriber_views']++;
+                        }
+                    }
+
+                    if ($eventType === 'academy_engaged_view') {
+                        $metrics[$key]['engaged_views']++;
+                        $engagedDurations[$key][] = max(0, (int) ($event->metadata['engaged_seconds'] ?? 15));
+                    }
+
+                    if ($eventType === 'academy_scroll_50') {
+                        $metrics[$key]['scroll_50']++;
+                    }
+                    if ($eventType === 'academy_scroll_75') {
+                        $metrics[$key]['scroll_75']++;
+                    }
+                    if ($eventType === 'academy_scroll_100') {
+                        $metrics[$key]['scroll_100']++;
+                    }
+                    if ($eventType === 'academy_prompt_copy') {
+                        $metrics[$key]['prompt_copies']++;
+                    }
+                    if ($eventType === 'academy_prompt_negative_copy') {
+                        $metrics[$key]['negative_prompt_copies']++;
+                    }
+                    if (in_array($eventType, ['academy_lesson_started', 'academy_course_started', 'academy_challenge_started'], true)) {
+                        $metrics[$key]['starts']++;
+                    }
+                    if (in_array($eventType, ['academy_lesson_completed', 'academy_course_completed', 'academy_challenge_submitted'], true)) {
+                        $metrics[$key]['completions']++;
+                    }
+                    if ($eventType === 'academy_upgrade_click') {
+                        $metrics[$key]['upgrade_clicks']++;
+                    }
+                    if ($eventType === 'academy_premium_preview_view') {
+                        $metrics[$key]['premium_preview_views']++;
+                    }
+                    if ($eventType === 'academy_search_result_click') {
+                        $metrics[$key]['search_clicks']++;
+
+                        $searchKey = $this->metricKey(AcademyAnalyticsContentType::SEARCH, null);
+                        $this->ensureMetric($metrics, AcademyAnalyticsContentType::SEARCH, null, $searchKey);
+                        $metrics[$searchKey]['search_clicks']++;
+                    }
+                }
+            });
+
+        foreach (AcademyLike::query()->whereBetween('created_at', [$start, $end])->get() as $like) {
+            $key = $this->metricKey((string) $like->content_type, (int) $like->content_id);
+            $this->ensureMetric($metrics, (string) $like->content_type, (int) $like->content_id, $key);
+            $metrics[$key]['likes']++;
+        }
+
+        foreach (AcademySave::query()->whereBetween('created_at', [$start, $end])->get() as $save) {
+            $key = $this->metricKey((string) $save->content_type, (int) $save->content_id);
+            $this->ensureMetric($metrics, (string) $save->content_type, (int) $save->content_id, $key);
+            $metrics[$key]['saves']++;
+        }
+
+        foreach (AcademySearchLog::query()->whereBetween('created_at', [$start, $end])->get() as $searchLog) {
+            $key = $this->metricKey(AcademyAnalyticsContentType::SEARCH, null);
+            $this->ensureMetric($metrics, AcademyAnalyticsContentType::SEARCH, null, $key);
+            $metrics[$key]['search_impressions']++;
+            if ((int) $searchLog->results_count === 0) {
+                $metrics[$key]['bounce_count']++;
+            }
+
+            $visitorKey = $searchLog->user_id ? sprintf('user:%d', (int) $searchLog->user_id) : trim((string) ($searchLog->visitor_id ?? ''));
+            if ($visitorKey !== '') {
+                $uniqueVisitors[$key][$visitorKey] = true;
+            }
+        }
+
+        foreach ($metrics as $key => $metric) {
+            $metric['unique_visitors'] = isset($uniqueVisitors[$key]) ? count($uniqueVisitors[$key]) : 0;
+            $metric['avg_engaged_seconds'] = isset($engagedDurations[$key]) && $engagedDurations[$key] !== []
+                ? (int) round(array_sum($engagedDurations[$key]) / count($engagedDurations[$key]))
+                : null;
+            $metric['bounce_count'] = max((int) ($metric['bounce_count'] ?? 0), max(0, (int) $metric['views'] - (int) $metric['engaged_views']));
+            $metric['popularity_score'] = $this->popularity->calculatePopularityScore($metric);
+            $metric['conversion_score'] = $this->popularity->calculateConversionScore($metric);
+
+            AcademyContentMetricDaily::query()->upsert([
+                array_merge($metric, [
+                    'date' => $date->copy()->startOfDay(),
+                    'created_at' => now(),
+                    'updated_at' => now(),
+                ]),
+            ], ['date', 'content_type', 'content_id'], [
+                'views',
+                'unique_visitors',
+                'guest_views',
+                'user_views',
+                'subscriber_views',
+                'engaged_views',
+                'scroll_50',
+                'scroll_75',
+                'scroll_100',
+                'likes',
+                'saves',
+                'prompt_copies',
+                'negative_prompt_copies',
+                'starts',
+                'completions',
+                'upgrade_clicks',
+                'premium_preview_views',
+                'search_impressions',
+                'search_clicks',
+                'bounce_count',
+                'avg_engaged_seconds',
+                'popularity_score',
+                'conversion_score',
+                'updated_at',
+            ]);
+        }
+    }
+
+    /**
+     * @param  array<string, array<string, mixed>>  $metrics
+     */
+    private function ensureMetric(array &$metrics, string $contentType, ?int $contentId, string $key): void
+    {
+        if (isset($metrics[$key])) {
+            return;
+        }
+
+        $metrics[$key] = [
+            'content_type' => $contentType,
+            'content_id' => $contentId,
+            'views' => 0,
+            'unique_visitors' => 0,
+            'guest_views' => 0,
+            'user_views' => 0,
+            'subscriber_views' => 0,
+            'engaged_views' => 0,
+            'scroll_50' => 0,
+            'scroll_75' => 0,
+            'scroll_100' => 0,
+            'likes' => 0,
+            'saves' => 0,
+            'prompt_copies' => 0,
+            'negative_prompt_copies' => 0,
+            'starts' => 0,
+            'completions' => 0,
+            'upgrade_clicks' => 0,
+            'premium_preview_views' => 0,
+            'search_impressions' => 0,
+            'search_clicks' => 0,
+            'bounce_count' => 0,
+            'avg_engaged_seconds' => null,
+            'popularity_score' => 0,
+            'conversion_score' => 0,
+        ];
+    }
+
+    private function metricKey(string $contentType, ?int $contentId): string
+    {
+        return sprintf('%s:%s', $contentType, $contentId ?? 'none');
+    }
+
+    /**
+     * @return array{0: Carbon, 1: Carbon}
+     */
+    private function resolveRange(): array
+    {
+        $date = $this->option('date');
+        $from = $this->option('from');
+        $to = $this->option('to');
+
+        if (is_string($date) && trim($date) !== '') {
+            $resolved = Carbon::parse($date)->startOfDay();
+
+            return [$resolved, $resolved->copy()];
+        }
+
+        $resolvedFrom = is_string($from) && trim($from) !== ''
+            ? Carbon::parse($from)->startOfDay()
+            : now()->subDay()->startOfDay();
+        $resolvedTo = is_string($to) && trim($to) !== ''
+            ? Carbon::parse($to)->startOfDay()
+            : $resolvedFrom->copy();
+
+        return [$resolvedFrom, $resolvedTo];
+    }
+}

app/Console/Commands/AcademyBillingHealthCommand.php

@@ -0,0 +1,305 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Services\Academy\AcademyBillingPlanService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Schema;
+
+final class AcademyBillingHealthCommand extends Command
+{
+    protected $signature = 'academy:billing-health
+        {--json : Output machine-readable JSON}
+        {--strict : Exit non-zero when blocking issues are found}';
+
+    protected $description = 'Inspect Academy Stripe billing deployment readiness, config completeness, and Cashier route wiring';
+
+    public function __construct(
+        private readonly AcademyBillingPlanService $plans,
+    ) {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $report = $this->buildReport();
+
+        if ((bool) $this->option('json')) {
+            $this->line((string) json_encode($report, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+
+            return $this->exitCodeFor($report);
+        }
+
+        $this->line('Academy Billing Health Check');
+        $this->line('============================');
+        $this->newLine();
+        $this->line(sprintf('Environment: %s', $report['environment']));
+        $this->line(sprintf('App URL: %s', $report['app_url'] ?? 'unset'));
+        $this->line(sprintf('Academy enabled: %s', $report['academy_enabled'] ? 'yes' : 'no'));
+        $this->line(sprintf('Academy billing enabled: %s', $report['academy_billing_enabled'] ? 'yes' : 'no'));
+        $this->line(sprintf('Subscription name: %s', $report['subscription_name']));
+        $this->line(sprintf('Cashier path: %s', $report['cashier_path']));
+        $this->line(sprintf('Cashier webhook route: %s', $report['routes']['cashier_webhook']['present'] ? ($report['routes']['cashier_webhook']['url'] ?? 'present') : 'missing'));
+        $this->line(sprintf('Academy pricing route: %s', $report['routes']['academy_pricing']['present'] ? ($report['routes']['academy_pricing']['url'] ?? 'present') : 'missing'));
+        $this->line(sprintf('Academy billing account route: %s', $report['routes']['academy_billing_account']['present'] ? ($report['routes']['academy_billing_account']['url'] ?? 'present') : 'missing'));
+        $this->line(sprintf('Stripe key configured: %s', $report['stripe']['publishable_key_configured'] ? 'yes' : 'no'));
+        $this->line(sprintf('Stripe secret configured: %s', $report['stripe']['secret_key_configured'] ? 'yes' : 'no'));
+        $this->line(sprintf('Webhook secret configured: %s', $report['stripe']['webhook_secret_configured'] ? 'yes' : 'no'));
+        $this->line(sprintf('Cashier currency: %s', $report['stripe']['currency'] ?: 'unset'));
+        $this->line(sprintf('Cashier locale: %s', $report['stripe']['currency_locale'] ?: 'unset'));
+        $this->line(sprintf('Configured plans: %d', $report['configured_plan_count']));
+        $this->line(sprintf('Plans missing Stripe price IDs: %d', count($report['missing_plan_keys'])));
+        $this->line(sprintf('Billing tables present: %s', $report['tables']['subscriptions'] && $report['tables']['subscription_items'] && $report['tables']['academy_billing_events'] ? 'yes' : 'no'));
+        $this->line(sprintf('User billing columns present: %s', $report['users_billing_columns_present'] ? 'yes' : 'no'));
+        $this->newLine();
+
+        foreach ($report['blockers'] as $blocker) {
+            $this->error(sprintf('BLOCKER: %s', $blocker));
+        }
+
+        foreach ($report['warnings'] as $warning) {
+            $this->warn(sprintf('WARNING: %s', $warning));
+        }
+
+        if ($report['plan_summaries'] !== []) {
+            $this->newLine();
+            $this->line('Plans');
+            $this->line('-----');
+
+            foreach ($report['plan_summaries'] as $plan) {
+                $this->line(sprintf(
+                    '%s: tier=%s interval=%s price_id=%s',
+                    $plan['key'],
+                    $plan['tier'],
+                    $plan['interval'],
+                    $plan['configured'] ? 'configured' : 'missing'
+                ));
+            }
+        }
+
+        $this->newLine();
+        $this->info(sprintf('Status: %s', $report['status']));
+
+        return $this->exitCodeFor($report);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function buildReport(): array
+    {
+        $stripeKey = $this->configuredString(config('cashier.key'));
+        $stripeSecret = $this->firstConfiguredString(config('cashier.secret'), env('STRIPE_SECRET'));
+        $webhookSecret = $this->firstConfiguredString(config('cashier.webhook.secret'), env('STRIPE_WEBHOOK_SECRET'));
+        $currency = trim((string) config('cashier.currency', env('CASHIER_CURRENCY', '')));
+        $currencyLocale = trim((string) config('cashier.currency_locale', env('CASHIER_CURRENCY_LOCALE', '')));
+        $academyEnabled = (bool) config('academy.enabled', true);
+        $billingEnabled = $this->plans->enabled();
+        $missingPlanKeys = $this->plans->missingPriceIds();
+        $routes = [
+            'cashier_webhook' => $this->routeStatus('cashier.webhook'),
+            'academy_pricing' => $this->routeStatus('academy.pricing'),
+            'academy_billing_account' => $this->routeStatus('academy.billing.account'),
+            'academy_billing_portal' => $this->routeStatus('academy.billing.portal'),
+            'admin_academy_billing' => $this->routeStatus('admin.academy.billing'),
+        ];
+        $tables = [
+            'users' => Schema::hasTable('users'),
+            'subscriptions' => Schema::hasTable('subscriptions'),
+            'subscription_items' => Schema::hasTable('subscription_items'),
+            'academy_billing_events' => Schema::hasTable('academy_billing_events'),
+        ];
+        $userBillingColumns = [
+            'stripe_id' => $tables['users'] && Schema::hasColumn('users', 'stripe_id'),
+            'pm_type' => $tables['users'] && Schema::hasColumn('users', 'pm_type'),
+            'pm_last_four' => $tables['users'] && Schema::hasColumn('users', 'pm_last_four'),
+            'trial_ends_at' => $tables['users'] && Schema::hasColumn('users', 'trial_ends_at'),
+        ];
+        $planSummaries = collect(array_keys($this->plans->plans()))
+            ->map(function (string $key): array {
+                $plan = $this->plans->plan($key);
+
+                return [
+                    'key' => $key,
+                    'tier' => (string) ($plan['tier'] ?? 'free'),
+                    'interval' => (string) ($plan['interval'] ?? 'monthly'),
+                    'configured' => (bool) ($plan['configured'] ?? false),
+                ];
+            })
+            ->values()
+            ->all();
+
+        $blockers = [];
+        $warnings = [];
+
+        if (! $academyEnabled) {
+            $warnings[] = 'SKINBASE_ACADEMY_ENABLED is disabled, so billing cannot be reached by users.';
+        }
+
+        if (! $billingEnabled) {
+            $warnings[] = 'ACADEMY_BILLING_ENABLED is disabled. Checkout routes will stay unavailable until rollout is enabled.';
+        }
+
+        if (! $this->isConfiguredSecret($stripeKey, 'pk_')) {
+            $blockers[] = 'STRIPE_KEY is missing or still using a placeholder value.';
+        }
+
+        if (! $this->isConfiguredSecret($stripeSecret, 'sk_')) {
+            $blockers[] = 'STRIPE_SECRET is missing or still using a placeholder value.';
+        }
+
+        if (! $this->isConfiguredSecret($webhookSecret, 'whsec_')) {
+            $blockers[] = 'STRIPE_WEBHOOK_SECRET is missing or still using a placeholder value.';
+        }
+
+        if ($currency === '') {
+            $blockers[] = 'CASHIER_CURRENCY is not configured.';
+        }
+
+        if ($currencyLocale === '') {
+            $warnings[] = 'CASHIER_CURRENCY_LOCALE is not configured.';
+        }
+
+        if ($missingPlanKeys !== []) {
+            $blockers[] = 'Stripe price IDs are missing for: '.implode(', ', $missingPlanKeys).'.';
+        }
+
+        if (! $routes['cashier_webhook']['present']) {
+            $blockers[] = 'Cashier webhook route is missing; Stripe cannot sync subscriptions.';
+        }
+
+        if (! $routes['academy_pricing']['present']) {
+            $blockers[] = 'Academy pricing route is missing.';
+        }
+
+        if (! $routes['academy_billing_account']['present']) {
+            $blockers[] = 'Academy billing account route is missing.';
+        }
+
+        foreach ($tables as $table => $present) {
+            if (! $present) {
+                $blockers[] = sprintf('Required billing table %s is missing.', $table);
+            }
+        }
+
+        foreach ($userBillingColumns as $column => $present) {
+            if (! $present) {
+                $blockers[] = sprintf('Required users.%s billing column is missing.', $column);
+            }
+        }
+
+        if (! $routes['admin_academy_billing']['present']) {
+            $warnings[] = 'Moderation Academy billing overview route is missing.';
+        }
+
+        if (Arr::where($planSummaries, fn (array $plan): bool => $plan['configured'] === false) === []) {
+            $warnings[] = 'All configured Academy plans have Stripe price IDs. Verify they are live-mode IDs before production rollout.';
+        }
+
+        $invalidPlanKeys = collect(array_keys($this->plans->plans()))
+            ->filter(function (string $key): bool {
+                $plan = $this->plans->plan($key);
+
+                return $plan !== null && ($plan['configured'] ?? false) && ! ($plan['price_id_valid'] ?? false);
+            })
+            ->values()
+            ->all();
+
+        if ($invalidPlanKeys !== []) {
+            $blockers[] = 'Stripe price IDs are malformed for: '.implode(', ', $invalidPlanKeys).'. Use real price object IDs that start with price_.';
+        }
+
+        $status = $blockers !== []
+            ? 'BLOCKED'
+            : ($warnings !== [] ? 'WARNING' : 'OK');
+
+        return [
+            'environment' => app()->environment(),
+            'app_url' => config('app.url'),
+            'academy_enabled' => $academyEnabled,
+            'academy_billing_enabled' => $billingEnabled,
+            'subscription_name' => $this->plans->subscriptionName(),
+            'cashier_path' => (string) config('cashier.path', 'stripe'),
+            'stripe' => [
+                'publishable_key_configured' => $this->isConfiguredSecret($stripeKey, 'pk_'),
+                'secret_key_configured' => $this->isConfiguredSecret($stripeSecret, 'sk_'),
+                'webhook_secret_configured' => $this->isConfiguredSecret($webhookSecret, 'whsec_'),
+                'currency' => $currency,
+                'currency_locale' => $currencyLocale,
+            ],
+            'configured_plan_count' => count($planSummaries),
+            'missing_plan_keys' => $missingPlanKeys,
+            'invalid_plan_keys' => $invalidPlanKeys,
+            'plan_summaries' => $planSummaries,
+            'routes' => $routes,
+            'tables' => $tables,
+            'user_billing_columns' => $userBillingColumns,
+            'users_billing_columns_present' => ! in_array(false, $userBillingColumns, true),
+            'blockers' => array_values(array_unique($blockers)),
+            'warnings' => array_values(array_unique($warnings)),
+            'status' => $status,
+        ];
+    }
+
+    /**
+     * @return array{present: bool, url: string|null}
+     */
+    private function routeStatus(string $name): array
+    {
+        if (! Route::has($name)) {
+            return [
+                'present' => false,
+                'url' => null,
+            ];
+        }
+
+        return [
+            'present' => true,
+            'url' => route($name),
+        ];
+    }
+
+    private function isConfiguredSecret(string $value, string $expectedPrefix): bool
+    {
+        $value = trim($value);
+
+        if ($value === '' || ! str_starts_with($value, $expectedPrefix)) {
+            return false;
+        }
+
+        return ! str_contains(strtolower($value), 'xxx');
+    }
+
+    /**
+     * @param array<string, mixed> $report
+     */
+    private function exitCodeFor(array $report): int
+    {
+        if ((bool) $this->option('strict') && $report['status'] === 'BLOCKED') {
+            return self::FAILURE;
+        }
+
+        return self::SUCCESS;
+    }
+    private function firstConfiguredString(mixed ...$values): string
+    {
+        foreach ($values as $value) {
+            $value = $this->configuredString($value);
+
+            if ($value !== '') {
+                return $value;
+            }
+        }
+
+        return '';
+    }
+
+    private function configuredString(mixed $value): string
+    {
+        return is_string($value) ? trim($value) : '';
+    }
+}

app/Console/Commands/AdsenseSyncCommand.php

@@ -0,0 +1,137 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\AdsenseSyncResult;
+use App\Services\Adsense\AdsenseSyncService;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+
+final class AdsenseSyncCommand extends Command
+{
+    protected $signature = 'adsense:sync
+        {--days= : Number of trailing days to synchronize, including today}
+        {--from= : Inclusive start date (YYYY-MM-DD)}
+        {--to= : Inclusive end date (YYYY-MM-DD)}
+        {--entities-only : Synchronize ad units and custom channels without reports}
+        {--force : Run even when ADSENSE_SYNC_ENABLED is false}';
+
+    protected $description = 'Synchronize Google AdSense entities and daily reporting into Skinbase';
+
+    public function handle(AdsenseSyncService $sync): int
+    {
+        if (! (bool) config('adsense.sync_enabled', true) && ! $this->option('force')) {
+            $this->warn('AdSense synchronization is disabled. Use --force to run anyway.');
+
+            return self::SUCCESS;
+        }
+
+        try {
+            [$from, $to] = $this->resolveRange();
+        } catch (\InvalidArgumentException $exception) {
+            $this->error($exception->getMessage());
+
+            return self::INVALID;
+        }
+
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->hasRefreshToken()) {
+            $this->error('Google AdSense is not connected.');
+
+            return self::FAILURE;
+        }
+
+        if ($connection->status === AdsenseConnection::STATUS_RECONNECT_REQUIRED) {
+            $this->error('AdSense authorization expired or was revoked. Reconnect Google AdSense.');
+
+            return self::FAILURE;
+        }
+
+        if ((string) $connection->account_resource_name === '') {
+            $this->error('No AdSense account is selected.');
+
+            return self::FAILURE;
+        }
+
+        $entitiesOnly = (bool) $this->option('entities-only');
+        $result = $sync->sync($connection, $from, $to, $entitiesOnly);
+
+        $this->renderResult($result, $entitiesOnly);
+
+        if ($result->reconnectRequired) {
+            $this->error('AdSense authorization expired or was revoked. Reconnect Google AdSense.');
+
+            return self::FAILURE;
+        }
+
+        if ($result->failedReports !== []) {
+            $this->warn('Synchronization completed with partial report failures: '.implode(', ', $result->failedReports));
+
+            return self::SUCCESS;
+        }
+
+        $this->info('Synchronization completed successfully.');
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * @return array{0: Carbon, 1: Carbon}
+     */
+    private function resolveRange(): array
+    {
+        $days = $this->option('days');
+        $from = $this->option('from');
+        $to = $this->option('to');
+
+        if ($days !== null && ($from !== null || $to !== null)) {
+            throw new \InvalidArgumentException('The --days option cannot be combined with --from or --to.');
+        }
+
+        if (($from !== null) !== ($to !== null)) {
+            throw new \InvalidArgumentException('Both --from and --to are required for a custom range.');
+        }
+
+        if (is_string($from) && is_string($to)) {
+            $start = Carbon::parse($from)->startOfDay();
+            $end = Carbon::parse($to)->startOfDay();
+            if ($end->lt($start)) {
+                throw new \InvalidArgumentException('The --to date must be on or after --from.');
+            }
+
+            return [$start, $end];
+        }
+
+        $trailingDays = $days !== null ? max(1, (int) $days) : 3;
+        $end = now()->startOfDay();
+        $start = $end->copy()->subDays($trailingDays - 1);
+
+        return [$start, $end];
+    }
+
+    private function renderResult(AdsenseSyncResult $result, bool $entitiesOnly): void
+    {
+        $this->line('AdSense account: '.($result->accountDisplayName !== '' ? $result->accountDisplayName : 'unknown'));
+        $this->line('Range: '.$result->from.' -> '.$result->to);
+        $this->newLine();
+        $this->line('Entities:');
+        $this->line('  Ad units: '.$result->adUnits);
+        $this->line('  Custom channels: '.$result->customChannels);
+
+        if ($entitiesOnly) {
+            return;
+        }
+
+        $this->newLine();
+        $this->line('Reports:');
+        $this->line('  Total: '.$result->totalRows);
+        $this->line('  Ad units: '.$result->adUnitRows);
+        $this->line('  Custom channels: '.$result->customChannelRows);
+        $this->line('  Platform: '.$result->platformRows);
+        $this->line('  Countries: '.$result->countryRows);
+        $this->newLine();
+    }
+}

app/Console/Commands/AuditArtworkDownloadFilesCommand.php

@@ -18,6 +18,9 @@ final class AuditArtworkDownloadFilesCommand extends Command
         {--id= : Audit only this artwork ID}
         {--limit= : Stop after processing this many artworks}
         {--chunk=500 : Number of artworks to scan per batch}
+        {--status= : Only inspect records with this persisted download status}
+        {--missing-only : Only report unresolved records}
+        {--mark-status : Persist the resolved availability status (explicit write)}
         {--restore-missing : Copy missing local originals from object storage when available}';
 
     protected $description = 'Scan artworks in descending ID order and report missing local download files with full URLs.';
@@ -28,6 +31,8 @@ final class AuditArtworkDownloadFilesCommand extends Command
         $limit = $this->option('limit') !== null ? max(1, (int) $this->option('limit')) : null;
         $chunkSize = max(1, min((int) $this->option('chunk'), 2000));
         $restoreMissing = (bool) $this->option('restore-missing');
+        $markStatus = (bool) $this->option('mark-status');
+        $statusFilter = $this->option('status');
 
         $this->info(sprintf(
             'Starting download file audit. order=desc include_trashed=yes chunk=%d limit=%s restore_missing=%s',
@@ -41,10 +46,11 @@ final class AuditArtworkDownloadFilesCommand extends Command
         $unresolved = 0;
         $restored = 0;
         $restoreFailed = 0;
+        $classifications = [];
         $lastSeenId = null;
 
         do {
-            $artworks = $this->nextChunk($artworkId, $chunkSize, $lastSeenId);
+            $artworks = $this->nextChunk($artworkId, $chunkSize, $lastSeenId, is_string($statusFilter) ? $statusFilter : null);
             if ($artworks->isEmpty()) {
                 break;
             }
@@ -54,41 +60,59 @@ final class AuditArtworkDownloadFilesCommand extends Command
                     break 2;
                 }
 
-                $localPath = $locator->resolveLocalPath($artwork);
+                $resolution = $locator->resolve($artwork);
-                $missingReason = null;
+                $classification = match ($resolution['status']) {
-
+                    'available' => strtoupper((string) $resolution['source']).'_OK',
-                if ($localPath === '') {
+                    'pending' => 'PENDING',
-                    $missingReason = 'unresolved_local_path';
+                    'unknown' => 'AMBIGUOUS',
+                    default => 'MISSING_EVERYWHERE',
+                };
+                $classifications[$classification] = ($classifications[$classification] ?? 0) + 1;
+                $localPath = (string) $resolution['path'];
+                $missingReason = $resolution['status'] === 'missing' ? 'missing_everywhere' : null;
+                if ($missingReason !== null) {
                     $unresolved++;
-                } elseif (! File::isFile($localPath)) {
+                }
-                    $missingReason = 'missing_local_file';
+
+                if ($markStatus) {
+                    $this->persistStatus($artwork, $resolution);
+                }
+
+                if ($missingReason === null && (bool) $this->option('missing-only')) {
+                    $processed++;
+
+                    continue;
+                }
+
+                if ($missingReason === null) {
+                    $this->line(sprintf('Artwork %d %s source=%s', (int) $artwork->id, $classification, (string) $resolution['source']));
                 }
 
                 if ($missingReason !== null) {
-                    $objectPath = $locator->resolveObjectPath($artwork);
+                    $objectPath = (string) $resolution['object_key'];
                     $objectUrl = $locator->resolveObjectUrl($artwork);
 
                     $missing++;
                     $this->warn(sprintf('Artwork %d %s', (int) $artwork->id, $missingReason));
-                    $this->line('  artwork_url: ' . route('art.show', [
+                    $this->line('  artwork_url: '.route('art.show', [
                         'id' => (int) $artwork->id,
                         'slug' => (string) ($artwork->slug ?? ''),
                     ]));
-                    $this->line('  download_url: ' . route('art.download', ['id' => (int) $artwork->id]));
+                    $this->line('  download_url: '.route('art.download', ['id' => (int) $artwork->id]));
 
                     if ($objectPath !== '') {
-                        $this->line('  object_path: ' . $objectPath);
+                        $this->line('  object_path: '.$objectPath);
                     }
 
                     if ($objectUrl !== null && $objectUrl !== '') {
-                        $this->line('  object_url: ' . $objectUrl);
+                        $this->line('  object_url: '.$objectUrl);
                     }
 
                     if ($localPath !== '') {
-                        $this->line('  local_path: ' . $localPath);
+                        $this->line('  local_path: '.$localPath);
                     }
 
-                    if ($restoreMissing && $missingReason === 'missing_local_file' && $localPath !== '') {
+                    if ($restoreMissing && $missingReason === 'missing_everywhere' && $localPath !== '') {
                         $restoreResult = $this->restoreLocalFile($storage, $objectPath, $localPath);
 
                         if ($restoreResult === 'restored') {
@@ -120,6 +144,9 @@ final class AuditArtworkDownloadFilesCommand extends Command
             $restored,
             $restoreFailed,
         ));
+        foreach ($classifications as $classification => $count) {
+            $this->line(sprintf('classification=%s count=%d', $classification, $count));
+        }
 
         return self::SUCCESS;
     }
@@ -127,11 +154,15 @@ final class AuditArtworkDownloadFilesCommand extends Command
     /**
      * @return Collection<int, Artwork>
      */
-    private function nextChunk(?int $artworkId, int $chunkSize, ?int $lastSeenId): Collection
+    private function nextChunk(?int $artworkId, int $chunkSize, ?int $lastSeenId, ?string $status): Collection
     {
+        if ($artworkId !== null && $lastSeenId !== null) {
+            return collect();
+        }
+
         $query = Artwork::query()
             ->withTrashed()
-            ->select(['id', 'slug', 'file_path', 'hash', 'file_ext'])
+            ->select(['id', 'slug', 'file_name', 'file_path', 'hash', 'file_ext'])
             ->orderByDesc('id');
 
         if ($artworkId !== null) {
@@ -140,9 +171,30 @@ final class AuditArtworkDownloadFilesCommand extends Command
             $query->where('id', '<', $lastSeenId);
         }
 
+        if ($status !== null && $status !== '') {
+            $query->where('download_status', $status);
+        }
+
         return $query->limit($chunkSize)->get();
     }
 
+    /** @param array{status:string,source:?string} $resolution */
+    private function persistStatus(Artwork $artwork, array $resolution): void
+    {
+        $status = match ($resolution['status']) {
+            'available' => 'available',
+            'pending' => 'pending',
+            'unknown' => 'unknown',
+            default => 'missing',
+        };
+
+        $artwork->forceFill([
+            'download_status' => $status,
+            'download_source' => $resolution['source'],
+            'download_checked_at' => now(),
+        ])->saveQuietly();
+    }
+
     private function restoreLocalFile(UploadStorageService $storage, string $objectPath, string $localPath): string
     {
         if ($objectPath === '') {

app/Console/Commands/BackfillArtworkPrimaryCategoryCommand.php

@@ -0,0 +1,139 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\Artwork;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+final class BackfillArtworkPrimaryCategoryCommand extends Command
+{
+    protected $signature = 'artworks:backfill-primary-category
+        {--dry-run : Report without writing (default unless --apply is passed)}
+        {--report : Print category-count distribution and conflicts}
+        {--apply : Write primary_category_id for artworks with exactly one category}
+        {--force : Overwrite existing primary_category_id values}';
+
+    protected $description = 'Backfill artworks.primary_category_id from unique artwork_category memberships';
+
+    public function handle(): int
+    {
+        $apply = (bool) $this->option('apply');
+        $force = (bool) $this->option('force');
+        $report = (bool) $this->option('report') || ! $apply;
+
+        if ($report) {
+            $this->printDistribution();
+        }
+
+        $conflicts = $this->conflictArtworkIds();
+        $zeros = $this->zeroCategoryArtworkIds();
+        $eligible = $this->eligibleArtworkIds($force);
+
+        $this->info('Zero-category artworks: '.$zeros->count());
+        $this->info('Single-category eligible for backfill: '.$eligible->count());
+        $this->info('Multi-category conflicts (not auto-resolved): '.$conflicts->count());
+
+        if ($conflicts->isNotEmpty()) {
+            $this->warn('Multi-category artwork IDs (first 50): '.$conflicts->take(50)->implode(', '));
+        }
+
+        if (! $apply) {
+            $this->comment('Dry run only. Re-run with --apply to write primary_category_id for single-category artworks.');
+
+            return self::SUCCESS;
+        }
+
+        $updated = 0;
+        foreach ($eligible->chunk(500) as $chunk) {
+            $rows = DB::table('artwork_category')
+                ->select('artwork_id', 'category_id')
+                ->whereIn('artwork_id', $chunk->all())
+                ->get()
+                ->groupBy('artwork_id');
+
+            foreach ($rows as $artworkId => $memberships) {
+                if ($memberships->count() !== 1) {
+                    continue;
+                }
+
+                $query = Artwork::query()->where('id', (int) $artworkId);
+                if (! $force) {
+                    $query->whereNull('primary_category_id');
+                }
+
+                $updated += $query->update([
+                    'primary_category_id' => (int) $memberships->first()->category_id,
+                ]);
+            }
+        }
+
+        $this->info("Updated {$updated} artwork(s).");
+
+        return self::SUCCESS;
+    }
+
+    private function printDistribution(): void
+    {
+        $distribution = DB::query()
+            ->fromSub(function ($query): void {
+                $query->from('artwork_category')
+                    ->select('artwork_id', DB::raw('COUNT(*) as category_count'))
+                    ->groupBy('artwork_id');
+            }, 'x')
+            ->select('category_count', DB::raw('COUNT(*) as artworks'))
+            ->groupBy('category_count')
+            ->orderBy('category_count')
+            ->get();
+
+        $this->table(['category_count', 'artworks'], $distribution->map(fn ($row): array => [
+            (int) $row->category_count,
+            (int) $row->artworks,
+        ])->all());
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function eligibleArtworkIds(bool $force)
+    {
+        $query = DB::table('artwork_category')
+            ->select('artwork_id')
+            ->groupBy('artwork_id')
+            ->havingRaw('COUNT(*) = 1');
+
+        if (! $force) {
+            $query->whereIn('artwork_id', Artwork::query()->whereNull('primary_category_id')->select('id'));
+        }
+
+        return $query->pluck('artwork_id')->map(fn ($id): int => (int) $id);
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function conflictArtworkIds()
+    {
+        return DB::table('artwork_category')
+            ->select('artwork_id')
+            ->groupBy('artwork_id')
+            ->havingRaw('COUNT(*) > 1')
+            ->orderByRaw('COUNT(*) DESC')
+            ->pluck('artwork_id')
+            ->map(fn ($id): int => (int) $id);
+    }
+
+    /**
+     * @return Collection<int, int>
+     */
+    private function zeroCategoryArtworkIds()
+    {
+        return Artwork::query()
+            ->whereDoesntHave('categories')
+            ->pluck('id')
+            ->map(fn ($id): int => (int) $id);
+    }
+}

app/Console/Commands/BuildSitemapsCommand.php

@@ -49,10 +49,10 @@ final class BuildSitemapsCommand extends Command
         $t = microtime(true);
         $this->line('  Building sitemap index…');
         $index = $build->buildIndex(force: true, persist: false, families: $families);
-        $disk->put('sitemap.xml', $index['content']);
+        $disk->put('sitemaps/sitemap.xml', $index['content']);
         $written++;
         $this->line(sprintf(
-            '  <info>✔</info>  sitemap.xml  %d entries  <comment>%.3fs</comment>',
+            '  <info>✔</info>  sitemaps/sitemap.xml  %d entries  <comment>%.3fs</comment>',
             $index['url_count'],
             microtime(true) - $t,
         ));
@@ -112,6 +112,36 @@ final class BuildSitemapsCommand extends Command
             ));
         }
 
+        foreach ($build->enabledGroupIndexes() as $groupName => $groupFamilies) {
+            foreach ($groupFamilies as $family) {
+                if (! in_array($family, $families, true)) {
+                    continue 2;
+                }
+            }
+
+            $t = microtime(true);
+            $this->line(sprintf('  Building grouped sitemap %s…', $groupName));
+
+            $built = $build->buildNamed($groupName, force: true, persist: false);
+
+            if ($built === null) {
+                $this->line(sprintf('  <comment>–</comment>  %s.xml  <fg=red>SKIPPED</>  (group builder returned null)', $groupName));
+                $failed++;
+
+                continue;
+            }
+
+            $disk->put('sitemaps/' . $groupName . '.xml', $built['content']);
+            $written++;
+
+            $this->line(sprintf(
+                '  <info>✔</info>  %s  %d entries  <comment>%.3fs</comment>',
+                $groupName . '.xml',
+                $built['url_count'] ?? 0,
+                microtime(true) - $t,
+            ));
+        }
+
         // ── Summary ───────────────────────────────────────────────────────
         $this->newLine();
         $this->info(sprintf(

app/Console/Commands/BuildWorldWebStoryAssetsCommand.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\WorldWebStory;
+use App\Services\WebStories\WorldWebStoryAssetService;
+use Illuminate\Console\Command;
+
+final class BuildWorldWebStoryAssetsCommand extends Command
+{
+    protected $signature = 'skinbase:webstories:build-assets
+        {story? : Story ID or slug}
+        {--published : Limit batch mode to published stories}
+        {--visible : Limit batch mode to stories currently visible on the public site}
+        {--limit=100 : Maximum stories to process in batch mode}
+        {--force : Rebuild already populated asset paths}
+        {--dry-run : Report changes without saving them}';
+
+    protected $description = 'Backfill poster, logo, and page background assets for World Web Stories';
+
+    public function handle(WorldWebStoryAssetService $assets): int
+    {
+        $storyKey = $this->argument('story');
+        $force = (bool) $this->option('force');
+        $dryRun = (bool) $this->option('dry-run');
+
+        if ($storyKey !== null && trim((string) $storyKey) !== '') {
+            $story = $this->resolveStory((string) $storyKey);
+
+            if (! $story instanceof WorldWebStory) {
+                $this->error(sprintf('Web story [%s] was not found.', (string) $storyKey));
+
+                return self::FAILURE;
+            }
+
+            return $this->buildOne($assets, $story, $force, $dryRun);
+        }
+
+        return $this->buildBatch($assets, $force, $dryRun, max(1, (int) $this->option('limit')));
+    }
+
+    private function buildOne(WorldWebStoryAssetService $assets, WorldWebStory $story, bool $force, bool $dryRun): int
+    {
+        $result = $assets->buildAssets($story, force: $force, dryRun: $dryRun);
+
+        $this->line(sprintf('Story [%d] %s', (int) $story->id, (string) $story->slug));
+        $this->line($result['updated'] ? 'Assets updated.' : 'No asset changes needed.');
+
+        foreach ((array) $result['story'] as $field => $value) {
+            $this->line(sprintf(' - story.%s = %s', (string) $field, (string) $value));
+        }
+
+        foreach ((array) $result['pages'] as $pageId => $changes) {
+            foreach ((array) $changes as $field => $value) {
+                $this->line(sprintf(' - page.%d.%s = %s', (int) $pageId, (string) $field, (string) $value));
+            }
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function buildBatch(WorldWebStoryAssetService $assets, bool $force, bool $dryRun, int $limit): int
+    {
+        $processed = 0;
+        $updated = 0;
+
+        $this->storyQuery()
+            ->limit($limit)
+            ->get()
+            ->each(function (WorldWebStory $story) use ($assets, $force, $dryRun, &$processed, &$updated): void {
+                $processed++;
+                $result = $assets->buildAssets($story, force: $force, dryRun: $dryRun);
+
+                if ($result['updated']) {
+                    $updated++;
+                }
+
+                $this->line(sprintf('[%d] %s -> %s', (int) $story->id, (string) $story->slug, $result['updated'] ? 'updated' : 'unchanged'));
+            });
+
+        $this->info(sprintf('Done. processed=%d updated=%d', $processed, $updated));
+
+        return self::SUCCESS;
+    }
+
+    private function storyQuery()
+    {
+        return WorldWebStory::query()
+            ->when((bool) $this->option('published'), fn ($query) => $query->published())
+            ->when((bool) $this->option('visible'), fn ($query) => $query->visible())
+            ->orderByDesc('published_at')
+            ->orderByDesc('id');
+    }
+
+    private function resolveStory(string $value): ?WorldWebStory
+    {
+        return WorldWebStory::query()
+            ->when(is_numeric($value), fn ($query) => $query->where('id', (int) $value), fn ($query) => $query->where('slug', $value))
+            ->first();
+    }
+}

app/Console/Commands/DispatchCollectionMaintenanceCommand.php

@@ -18,6 +18,12 @@ class DispatchCollectionMaintenanceCommand extends Command
 
     public function handle(CollectionBackgroundJobService $jobs): int
     {
+        if (! (bool) config('collections.v5.queue.dispatch_enabled', false)) {
+            $this->warn('Collection maintenance dispatch is disabled (COLLECTIONS_V5_DISPATCH_ENABLED). No jobs queued.');
+
+            return self::SUCCESS;
+        }
+
         $runHealth = (bool) $this->option('health');
         $runRecommendations = (bool) $this->option('recommendations');
         $runDuplicates = (bool) $this->option('duplicates');

app/Console/Commands/Enhance/CleanupEnhanceJobsCommand.php

@@ -0,0 +1,290 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Enhance;
+
+use App\Models\EnhanceJob;
+use App\Services\Enhance\EnhanceStorageService;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Storage;
+use Throwable;
+
+final class CleanupEnhanceJobsCommand extends Command
+{
+    protected $signature = 'enhance:cleanup
+        {--dry-run : Preview cleanup actions only}
+        {--force : Delete files and update records}
+        {--only= : Restrict cleanup to expired, deleted, failed, or orphaned}
+        {--days= : Override retention days for failed or deleted cleanup}';
+
+    protected $description = 'Safely clean expired, deleted, failed, and orphaned Enhance files.';
+
+    public function __construct(
+        private readonly EnhanceStorageService $storage,
+    ) {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $target = strtolower(trim((string) $this->option('only')));
+        $validTargets = ['', 'expired', 'deleted', 'failed', 'orphaned'];
+
+        if (! in_array($target, $validTargets, true)) {
+            $this->error('The --only option must be one of: expired, deleted, failed, orphaned.');
+
+            return self::FAILURE;
+        }
+
+        if ((bool) $this->option('dry-run') && (bool) $this->option('force')) {
+            $this->error('Use either --dry-run or --force, not both.');
+
+            return self::FAILURE;
+        }
+
+        $dryRun = (bool) $this->option('dry-run') || ! (bool) $this->option('force');
+        $daysOverride = $this->option('days');
+        $selectedTarget = $target !== '' ? $target : 'all';
+
+        Log::info('enhance.cleanup.started', [
+            'dry_run' => $dryRun,
+            'target' => $selectedTarget,
+            'days_override' => $daysOverride,
+        ]);
+
+        if ($dryRun) {
+            $this->warn('Running in dry-run mode. No files will be deleted.');
+        }
+
+        $rows = [];
+
+        if ($target === '' || $target === 'expired') {
+            $expired = $this->cleanupExpiredCompletedJobs($dryRun);
+            $rows[] = ['expired', $expired['jobs'], $expired['files'], $dryRun ? 'dry-run' : 'cleaned'];
+        }
+
+        if ($target === '' || $target === 'failed') {
+            $failed = $this->cleanupFailedJobs($dryRun, $daysOverride);
+            $rows[] = ['failed', $failed['jobs'], $failed['files'], $dryRun ? 'dry-run' : 'cleaned'];
+        }
+
+        if ($target === '' || $target === 'deleted') {
+            $deleted = $this->cleanupSoftDeletedJobs($dryRun, $daysOverride);
+            $rows[] = ['deleted', $deleted['jobs'], $deleted['files'], $dryRun ? 'dry-run' : 'cleaned'];
+        }
+
+        if ($target === 'orphaned') {
+            $orphaned = $this->scanOrphanedFiles($dryRun);
+            $rows[] = ['orphaned', $orphaned['files'], $orphaned['deleted'], $dryRun ? 'dry-run' : 'deleted'];
+
+            if ($orphaned['unsupported']) {
+                $this->warn('Orphaned file scan was skipped because the configured disk does not support safe listing.');
+            }
+
+            foreach ($orphaned['sample'] as $path) {
+                $this->line(' - ' . $path);
+            }
+        }
+
+        if ($rows !== []) {
+            $this->table(['Target', 'Jobs/Files', 'Files deleted', 'Mode'], $rows);
+        }
+
+        Log::info('enhance.cleanup.completed', [
+            'dry_run' => $dryRun,
+            'target' => $selectedTarget,
+            'rows' => $rows,
+        ]);
+
+        $this->info('Enhance cleanup finished.');
+
+        return self::SUCCESS;
+    }
+
+    private function cleanupExpiredCompletedJobs(bool $dryRun): array
+    {
+        $query = EnhanceJob::query()
+            ->where('status', EnhanceJob::STATUS_COMPLETED)
+            ->whereNotNull('expires_at')
+            ->where('expires_at', '<=', now());
+
+        return $this->cleanupJobs($query, $dryRun, 'expired', fn (): array => [
+            'status' => EnhanceJob::STATUS_EXPIRED,
+        ]);
+    }
+
+    private function cleanupFailedJobs(bool $dryRun, mixed $daysOverride): array
+    {
+        $days = $this->resolveDays($daysOverride, (int) config('enhance.lifecycle.failed_expires_after_days', 7));
+        $cutoff = now()->subDays($days);
+
+        $query = EnhanceJob::query()
+            ->where('status', EnhanceJob::STATUS_FAILED)
+            ->where(function (Builder $builder) use ($cutoff): void {
+                $builder
+                    ->where('finished_at', '<=', $cutoff)
+                    ->orWhere(function (Builder $fallback) use ($cutoff): void {
+                        $fallback->whereNull('finished_at')->where('created_at', '<=', $cutoff);
+                    });
+            });
+
+        return $this->cleanupJobs($query, $dryRun, 'failed-expired');
+    }
+
+    private function cleanupSoftDeletedJobs(bool $dryRun, mixed $daysOverride): array
+    {
+        $days = $this->resolveDays($daysOverride, (int) config('enhance.lifecycle.deleted_file_grace_days', 1));
+        $cutoff = now()->subDays($days);
+
+        $query = EnhanceJob::withTrashed()
+            ->whereNotNull('deleted_at')
+            ->where('deleted_at', '<=', $cutoff);
+
+        return $this->cleanupJobs($query, $dryRun, 'deleted-grace');
+    }
+
+    private function cleanupJobs(Builder $query, bool $dryRun, string $reason, ?callable $attributes = null): array
+    {
+        $result = ['jobs' => 0, 'files' => 0];
+        $chunkSize = max(1, (int) config('enhance.lifecycle.cleanup_chunk_size', 100));
+
+        $query->chunkById($chunkSize, function ($jobs) use (&$result, $dryRun, $reason, $attributes): void {
+            foreach ($jobs as $job) {
+                $result['jobs']++;
+                $result['files'] += count($this->enhanceJobPaths($job));
+
+                if ($dryRun) {
+                    continue;
+                }
+
+                $deleteResult = $this->storage->deleteFilesForJob($job);
+                $metadata = is_array($job->metadata) ? $job->metadata : [];
+
+                $job->forceFill(array_merge(
+                    $this->cleanupAttributesForJob($job),
+                    $attributes ? $attributes($job) : [],
+                    [
+                        'metadata' => array_merge($metadata, [
+                            'cleanup' => [
+                                'files_removed_at' => now()->toIso8601String(),
+                                'reason' => $reason,
+                                'deleted' => $deleteResult['deleted'],
+                            ],
+                        ]),
+                    ],
+                ))->save();
+            }
+        });
+
+        return $result;
+    }
+
+    private function scanOrphanedFiles(bool $dryRun): array
+    {
+        $disk = $this->storage->diskName();
+        $knownPaths = array_fill_keys(array_map(
+            static fn (string $path): string => ltrim($path, '/'),
+            $this->storage->listKnownJobPaths(),
+        ), true);
+        $sample = [];
+        $result = [
+            'files' => 0,
+            'deleted' => 0,
+            'unsupported' => false,
+            'sample' => [],
+        ];
+
+        foreach ($this->enhancePrefixes() as $prefix) {
+            try {
+                $files = Storage::disk($disk)->allFiles($prefix);
+            } catch (Throwable) {
+                $result['unsupported'] = true;
+
+                return $result;
+            }
+
+            foreach ($files as $file) {
+                $normalized = ltrim($file, '/');
+
+                if (isset($knownPaths[$normalized])) {
+                    continue;
+                }
+
+                $result['files']++;
+
+                if (count($sample) < 20) {
+                    $sample[] = $normalized;
+                }
+
+                if (! $dryRun && $this->storage->safeDelete($disk, $normalized)) {
+                    $result['deleted']++;
+                }
+            }
+        }
+
+        $result['sample'] = $sample;
+
+        return $result;
+    }
+
+    private function cleanupAttributesForJob(EnhanceJob $job): array
+    {
+        $attributes = [];
+
+        if ($this->storage->isEnhancePath($job->source_path)) {
+            $attributes['source_disk'] = null;
+            $attributes['source_path'] = null;
+            $attributes['source_hash'] = null;
+        }
+
+        if ($this->storage->isEnhancePath($job->output_path)) {
+            $attributes['output_disk'] = null;
+            $attributes['output_path'] = null;
+            $attributes['output_hash'] = null;
+            $attributes['output_width'] = null;
+            $attributes['output_height'] = null;
+            $attributes['output_filesize'] = null;
+            $attributes['output_mime'] = null;
+        }
+
+        if ($this->storage->isEnhancePath($job->preview_path)) {
+            $attributes['preview_disk'] = null;
+            $attributes['preview_path'] = null;
+        }
+
+        return $attributes;
+    }
+
+    private function enhanceJobPaths(EnhanceJob $job): array
+    {
+        return array_values(array_filter([
+            $this->storage->isEnhancePath($job->source_path) ? trim((string) $job->source_path) : null,
+            $this->storage->isEnhancePath($job->output_path) ? trim((string) $job->output_path) : null,
+            $this->storage->isEnhancePath($job->preview_path) ? trim((string) $job->preview_path) : null,
+        ]));
+    }
+
+    private function enhancePrefixes(): array
+    {
+        return array_values(array_filter(array_unique(array_map(
+            static fn (string $prefix): string => trim($prefix, '/'),
+            [
+                (string) config('enhance.source_prefix', 'enhance/sources'),
+                (string) config('enhance.output_prefix', 'enhance/outputs'),
+                (string) config('enhance.preview_prefix', 'enhance/previews'),
+            ],
+        ))));
+    }
+
+    private function resolveDays(mixed $daysOverride, int $default): int
+    {
+        if ($daysOverride === null || $daysOverride === '') {
+            return max(0, $default);
+        }
+
+        return max(0, (int) $daysOverride);
+    }
+}

app/Console/Commands/Enhance/EnhanceHealthCommand.php

@@ -0,0 +1,108 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Enhance;
+
+use App\Models\EnhanceJob;
+use Illuminate\Console\Command;
+
+final class EnhanceHealthCommand extends Command
+{
+    protected $signature = 'enhance:health {--json : Output machine-readable JSON}';
+
+    protected $description = 'Report operational health and lifecycle metrics for Enhance jobs.';
+
+    public function handle(): int
+    {
+        $payload = $this->payload();
+
+        if ((bool) $this->option('json')) {
+            $this->line(json_encode($payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
+
+            return self::SUCCESS;
+        }
+
+        $this->info('Enhance health');
+        $this->newLine();
+
+        $this->table(['Metric', 'Value'], [
+            ['Configured engine', $payload['engine']],
+            ['Configured queue', $payload['queue']],
+            ['Worker URL configured', $payload['worker_configured'] ? 'yes' : 'no'],
+            ['Storage disk', $payload['storage_disk']],
+            ['Total jobs', $payload['counts']['total']],
+            ['Pending jobs', $payload['counts']['pending']],
+            ['Queued jobs', $payload['counts']['queued']],
+            ['Processing jobs', $payload['counts']['processing']],
+            ['Completed jobs', $payload['counts']['completed']],
+            ['Failed jobs', $payload['counts']['failed']],
+            ['Cancelled jobs', $payload['counts']['cancelled']],
+            ['Expired jobs', $payload['counts']['expired']],
+            ['Stuck queued jobs', $payload['health']['stuck_queued']],
+            ['Stuck processing jobs', $payload['health']['stuck_processing']],
+            ['Jobs created today', $payload['today']['created']],
+            ['Jobs completed today', $payload['today']['completed']],
+            ['Jobs failed today', $payload['today']['failed']],
+            ['Average processing time today', $payload['today']['average_processing_seconds'] ?? '—'],
+        ]);
+
+        return self::SUCCESS;
+    }
+
+    private function payload(): array
+    {
+        $todayStart = now()->startOfDay();
+        $todayEnd = now()->endOfDay();
+        $stuckQueuedCutoff = now()->subMinutes((int) config('enhance.health.stuck_queued_after_minutes', 60));
+        $stuckProcessingCutoff = now()->subMinutes((int) config('enhance.health.stuck_processing_after_minutes', 30));
+
+        $counts = [
+            'total' => EnhanceJob::query()->count(),
+            'pending' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_PENDING)->count(),
+            'queued' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_QUEUED)->count(),
+            'processing' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_PROCESSING)->count(),
+            'completed' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_COMPLETED)->count(),
+            'failed' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_FAILED)->count(),
+            'cancelled' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_CANCELLED)->count(),
+            'expired' => EnhanceJob::query()->where('status', EnhanceJob::STATUS_EXPIRED)->count(),
+        ];
+
+        return [
+            'engine' => (string) config('enhance.default_engine', EnhanceJob::ENGINE_STUB),
+            'queue' => (string) config('enhance.queue', 'default'),
+            'worker_configured' => trim((string) config('enhance.external_worker.url', '')) !== '',
+            'storage_disk' => (string) config('enhance.disk', 'public'),
+            'counts' => $counts,
+            'health' => [
+                'stuck_queued' => EnhanceJob::query()
+                    ->where('status', EnhanceJob::STATUS_QUEUED)
+                    ->whereNotNull('queued_at')
+                    ->where('queued_at', '<=', $stuckQueuedCutoff)
+                    ->count(),
+                'stuck_processing' => EnhanceJob::query()
+                    ->where('status', EnhanceJob::STATUS_PROCESSING)
+                    ->whereNotNull('started_at')
+                    ->where('started_at', '<=', $stuckProcessingCutoff)
+                    ->count(),
+            ],
+            'today' => [
+                'created' => EnhanceJob::query()->whereBetween('created_at', [$todayStart, $todayEnd])->count(),
+                'completed' => EnhanceJob::query()
+                    ->where('status', EnhanceJob::STATUS_COMPLETED)
+                    ->whereBetween('finished_at', [$todayStart, $todayEnd])
+                    ->count(),
+                'failed' => EnhanceJob::query()
+                    ->where('status', EnhanceJob::STATUS_FAILED)
+                    ->whereBetween('finished_at', [$todayStart, $todayEnd])
+                    ->count(),
+                'average_processing_seconds' => ($average = EnhanceJob::query()
+                    ->whereNotNull('processing_seconds')
+                    ->whereBetween('finished_at', [$todayStart, $todayEnd])
+                    ->avg('processing_seconds')) !== null
+                    ? round((float) $average, 2)
+                    : null,
+            ],
+        ];
+    }
+}

app/Console/Commands/Enhance/EnhanceRunCommand.php

@@ -0,0 +1,290 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands\Enhance;
+
+use App\Models\EnhanceJob;
+use App\Services\Enhance\EnhanceProcessorFactory;
+use App\Services\Enhance\EnhanceStorageService;
+use Illuminate\Console\Command;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use Throwable;
+
+final class EnhanceRunCommand extends Command
+{
+    protected $signature = 'enhance:run
+        {--id= : Process specific job ID(s), comma-separated}
+        {--limit=1 : Max pending/queued jobs to pick up from the queue (0 = all)}
+        {--engine= : Override the processing engine for this run (stub, external_worker)}
+        {--failed : Also include failed jobs when scanning the queue}
+        {--dry-run : Show what would be processed without executing}';
+
+    protected $description = 'Synchronously process pending enhance jobs inline — useful for debugging with -v / -vv / -vvv.';
+
+    private const PROCESSABLE_STATUSES = [
+        EnhanceJob::STATUS_PENDING,
+        EnhanceJob::STATUS_QUEUED,
+        EnhanceJob::STATUS_PROCESSING,
+        EnhanceJob::STATUS_FAILED,
+    ];
+
+    public function __construct(
+        private readonly EnhanceProcessorFactory $processorFactory,
+        private readonly EnhanceStorageService $storage,
+    ) {
+        parent::__construct();
+    }
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $engineOverride = trim((string) $this->option('engine'));
+        $idOption = trim((string) $this->option('id'));
+        $limit = max(0, (int) $this->option('limit'));
+        $includeFailed = (bool) $this->option('failed');
+
+        if ($engineOverride !== '' && ! in_array($engineOverride, [EnhanceJob::ENGINE_STUB, EnhanceJob::ENGINE_EXTERNAL_WORKER], true)) {
+            $this->error("Unknown engine override: {$engineOverride}. Use 'stub' or 'external_worker'.");
+
+            return self::FAILURE;
+        }
+
+        $jobs = $this->resolveJobs($idOption, $limit, $includeFailed);
+
+        if ($jobs->isEmpty()) {
+            $this->info('No eligible enhance jobs found.');
+
+            return self::SUCCESS;
+        }
+
+        $this->info(sprintf('Found %d job(s) to process.', $jobs->count()));
+        $this->newLine();
+
+        if ($dryRun) {
+            $this->warn('Dry-run mode — no jobs will be processed.');
+
+            foreach ($jobs as $job) {
+                $engine = $engineOverride !== '' ? "{$engineOverride} (overridden)" : $job->engine;
+                $this->line(sprintf(
+                    '  [dry-run] Job #%d  status=%-12s engine=%-18s scale=%dx  mode=%-14s user_id=%d',
+                    $job->id,
+                    $job->status,
+                    $engine,
+                    $job->scale,
+                    $job->mode,
+                    $job->user_id,
+                ));
+            }
+
+            return self::SUCCESS;
+        }
+
+        $processed = 0;
+        $failed = 0;
+
+        foreach ($jobs as $job) {
+            if ($this->processJob($job, $engineOverride)) {
+                $processed++;
+            } else {
+                $failed++;
+            }
+
+            $this->newLine();
+        }
+
+        $this->info(sprintf('Done: %d completed, %d failed.', $processed, $failed));
+
+        return $failed > 0 ? self::FAILURE : self::SUCCESS;
+    }
+
+    private function resolveJobs(string $idOption, int $limit, bool $includeFailed): Collection
+    {
+        if ($idOption !== '') {
+            $ids = array_filter(array_map('intval', explode(',', $idOption)));
+
+            return EnhanceJob::query()
+                ->whereIn('id', $ids)
+                ->whereIn('status', self::PROCESSABLE_STATUSES)
+                ->get();
+        }
+
+        $statuses = [EnhanceJob::STATUS_PENDING, EnhanceJob::STATUS_QUEUED, EnhanceJob::STATUS_PROCESSING];
+
+        if ($includeFailed) {
+            $statuses[] = EnhanceJob::STATUS_FAILED;
+        }
+
+        $query = EnhanceJob::query()->whereIn('status', $statuses)->oldest();
+
+        if ($limit > 0) {
+            $query->limit($limit);
+        }
+
+        return $query->get();
+    }
+
+    private function processJob(EnhanceJob $job, string $engineOverride): bool
+    {
+        $engine = $engineOverride !== '' ? $engineOverride : (string) $job->engine;
+
+        $this->line(sprintf('<comment>--- Job #%d ---</comment>', $job->id));
+        $this->line(sprintf('  Status  : %s', $job->status));
+        $this->line(sprintf('  Engine  : %s%s', $engine, $engineOverride !== '' ? ' (overridden)' : ''));
+        $this->line(sprintf('  Scale   : %dx', $job->scale));
+        $this->line(sprintf('  Mode    : %s', $job->mode));
+        $this->line(sprintf('  User    : #%d', $job->user_id));
+
+        if ($this->output->isVerbose()) {
+            $this->line(sprintf(
+                '  Source  : disk=%-10s path=%s',
+                $job->source_disk ?: '(default)',
+                $job->source_path ?: '—',
+            ));
+            $this->line(sprintf(
+                '  Input   : %dx%d  size=%s  mime=%s',
+                (int) $job->input_width,
+                (int) $job->input_height,
+                $this->formatBytes((int) $job->input_filesize),
+                $job->input_mime ?: '—',
+            ));
+
+            if ($job->error_message !== null) {
+                $this->warn(sprintf('  Previous error: %s', $job->error_message));
+            }
+        }
+
+        if (! in_array($job->status, self::PROCESSABLE_STATUSES, true)) {
+            $this->warn(sprintf('  Skipping: status "%s" is not processable.', $job->status));
+
+            return false;
+        }
+
+        $job->forceFill([
+            'status' => EnhanceJob::STATUS_PROCESSING,
+            'started_at' => now(),
+            'finished_at' => null,
+            'error_message' => null,
+        ])->save();
+
+        $started = microtime(true);
+        $completedExpiryDays = (int) config('enhance.lifecycle.completed_expires_after_days', 30);
+
+        try {
+            $this->line('  Processing...');
+
+            $processor = $this->processorFactory->make($engine);
+            $result = $processor->process($job);
+
+            if ($this->output->isVerbose()) {
+                $this->line(sprintf(
+                    '  Output  : %dx%d  size=%s  mime=%s',
+                    $result->width,
+                    $result->height,
+                    $this->formatBytes($result->filesize),
+                    $result->mime,
+                ));
+                $this->line(sprintf(
+                    '  Stored  : disk=%-10s path=%s',
+                    $result->disk,
+                    $result->path,
+                ));
+            }
+
+            $this->line('  Generating preview...');
+            $preview = $this->storage->createPreviewFromStoredOutput($job, $result->disk, $result->path) ?? [];
+
+            $outputHash = null;
+            $outputContents = Storage::disk($result->disk)->get($result->path);
+
+            if (is_string($outputContents) && $outputContents !== '') {
+                $outputHash = hash('sha256', $outputContents);
+            }
+
+            $job->forceFill([
+                'status' => EnhanceJob::STATUS_COMPLETED,
+                'output_disk' => $result->disk,
+                'output_path' => $result->path,
+                'output_hash' => $outputHash,
+                'output_width' => $result->width,
+                'output_height' => $result->height,
+                'output_filesize' => $result->filesize,
+                'output_mime' => $result->mime,
+                'metadata' => array_merge($job->metadata ?? [], $result->metadata ?? []),
+                'processing_seconds' => (int) round(microtime(true) - $started),
+                'finished_at' => now(),
+                'expires_at' => $completedExpiryDays > 0 ? now()->addDays($completedExpiryDays) : null,
+            ] + $preview)->save();
+
+            $elapsed = round(microtime(true) - $started, 2);
+            $this->info(sprintf('  Completed in %.2fs', $elapsed));
+
+            if ($this->output->isVerbose() && ! empty($result->metadata)) {
+                $this->line('  Metadata:');
+
+                foreach ($result->metadata as $key => $value) {
+                    $display = is_scalar($value) ? (string) $value : json_encode($value);
+                    $this->line(sprintf('    %-30s %s', $key . ':', $display));
+                }
+            }
+
+            return true;
+        } catch (Throwable $exception) {
+            $elapsed = round(microtime(true) - $started, 2);
+
+            $job->forceFill([
+                'status' => EnhanceJob::STATUS_FAILED,
+                'error_message' => Str::limit($exception->getMessage(), 1000),
+                'processing_seconds' => (int) round(microtime(true) - $started),
+                'finished_at' => now(),
+            ])->save();
+
+            $this->error(sprintf('  Failed in %.2fs: %s', $elapsed, $exception->getMessage()));
+
+            if ($this->output->isVerbose()) {
+                $this->line(sprintf('  Exception : %s', get_class($exception)));
+                $this->line(sprintf('  At        : %s:%d', $exception->getFile(), $exception->getLine()));
+
+                $previous = $exception->getPrevious();
+
+                if ($previous !== null) {
+                    $this->line(sprintf('  Caused by : %s: %s', get_class($previous), $previous->getMessage()));
+                }
+            }
+
+            if ($this->output->isVeryVerbose()) {
+                $this->line('  Stack trace:');
+                $frames = array_slice(explode("\n", $exception->getTraceAsString()), 0, 25);
+
+                foreach ($frames as $frame) {
+                    $this->line('    ' . $frame);
+                }
+            }
+
+            Log::warning('enhance.run.command.failed', [
+                'enhance_job_id' => $job->id,
+                'engine' => $engine,
+                'message' => $exception->getMessage(),
+                'exception' => get_class($exception),
+            ]);
+
+            return false;
+        }
+    }
+
+    private function formatBytes(int $bytes): string
+    {
+        if ($bytes < 1024) {
+            return $bytes . 'B';
+        }
+
+        if ($bytes < 1_048_576) {
+            return round($bytes / 1024, 1) . 'KB';
+        }
+
+        return round($bytes / 1_048_576, 1) . 'MB';
+    }
+}

app/Console/Commands/GenerateAcademyPromptThumbnailsCommand.php

@@ -0,0 +1,390 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\AcademyPromptTemplate;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Storage;
+use RuntimeException;
+use Throwable;
+
+final class GenerateAcademyPromptThumbnailsCommand extends Command
+{
+    private const PROMPT_PREVIEW_PREFIX = 'academy-prompts/previews';
+
+    /**
+     * @var array<string, int>
+     */
+    private const VARIANT_WIDTHS = [
+        'thumb' => 480,
+        'md' => 960,
+    ];
+
+    private const PREVIEW_WEBP_QUALITY = 84;
+
+    private const LESSON_MEDIA_WEBP_QUALITY = 85;
+
+    protected $signature = 'academy:prompts:generate-missing-thumbnails
+        {--id=* : Restrict to one or more prompt IDs}
+        {--slug=* : Restrict to one or more prompt slugs}
+        {--limit= : Stop after processing this many prompts}
+        {--force : Regenerate variants even when they already exist}
+        {--dry-run : Report planned thumbnail work without writing files or saving prompt JSON}';
+
+    protected $description = 'Generate missing prompt preview and comparison thumbnails for existing Academy prompts';
+
+    public function handle(): int
+    {
+        if (! function_exists('imagecreatefromstring') || ! function_exists('imagewebp')) {
+            $this->error('GD WebP support is required to generate prompt thumbnails.');
+
+            return self::FAILURE;
+        }
+
+        $ids = collect((array) $this->option('id'))
+            ->map(static fn (mixed $id): int => (int) $id)
+            ->filter(static fn (int $id): bool => $id > 0)
+            ->values()
+            ->all();
+
+        $slugs = collect((array) $this->option('slug'))
+            ->map(static fn (mixed $slug): string => trim((string) $slug))
+            ->filter(static fn (string $slug): bool => $slug !== '')
+            ->values()
+            ->all();
+
+        $limit = $this->option('limit') !== null ? max(1, (int) $this->option('limit')) : null;
+        $force = (bool) $this->option('force');
+        $dryRun = (bool) $this->option('dry-run');
+
+        $query = AcademyPromptTemplate::query()
+            ->select(['id', 'slug', 'title', 'preview_image', 'tool_notes'])
+            ->orderBy('id');
+
+        if ($ids !== []) {
+            $query->whereIn('id', $ids);
+        }
+
+        if ($slugs !== []) {
+            $query->whereIn('slug', $slugs);
+        }
+
+        $processed = 0;
+        $changed = 0;
+        $generatedVariants = 0;
+        $plannedVariants = 0;
+        $skipped = 0;
+        $failed = 0;
+
+        $query->chunkById(100, function ($prompts) use ($limit, $force, $dryRun, &$processed, &$changed, &$generatedVariants, &$plannedVariants, &$skipped, &$failed) {
+            foreach ($prompts as $prompt) {
+                if ($limit !== null && $processed >= $limit) {
+                    return false;
+                }
+
+                try {
+                    $result = $this->backfillPrompt($prompt, $force, $dryRun);
+
+                    $generatedVariants += (int) ($result['generated_variants'] ?? 0);
+                    $plannedVariants += (int) ($result['planned_variants'] ?? 0);
+
+                    if (($result['changed'] ?? false) === true) {
+                        $changed++;
+                    } else {
+                        $skipped++;
+                    }
+                } catch (Throwable $e) {
+                    $failed++;
+                    $this->warn(sprintf('Prompt %d (%s) failed: %s', (int) $prompt->id, (string) $prompt->slug, $e->getMessage()));
+                }
+
+                $processed++;
+            }
+
+            return true;
+        });
+
+        $this->info(sprintf(
+            'Prompt thumbnail backfill complete. processed=%d changed=%d generated_variants=%d planned_variants=%d skipped=%d failed=%d',
+            $processed,
+            $changed,
+            $generatedVariants,
+            $plannedVariants,
+            $skipped,
+            $failed,
+        ));
+
+        return $failed > 0 ? self::FAILURE : self::SUCCESS;
+    }
+
+    /**
+     * @return array{changed:bool,generated_variants:int,planned_variants:int}
+     */
+    private function backfillPrompt(AcademyPromptTemplate $prompt, bool $force, bool $dryRun): array
+    {
+        $generatedVariants = 0;
+        $plannedVariants = 0;
+        $changed = false;
+
+        $previewResult = $this->ensureManagedImageVariants((string) ($prompt->preview_image ?? ''), $force, $dryRun);
+        $generatedVariants += $previewResult['generated_variants'];
+        $plannedVariants += $previewResult['planned_variants'];
+        $changed = $changed || $previewResult['changed'];
+
+        $notes = is_array($prompt->tool_notes) ? $prompt->tool_notes : [];
+        $nextNotes = [];
+
+        foreach ($notes as $note) {
+            if (! is_array($note)) {
+                $nextNotes[] = $note;
+                continue;
+            }
+
+            $noteResult = $this->ensurePromptComparisonNoteVariants($note, $force, $dryRun);
+            $generatedVariants += $noteResult['generated_variants'];
+            $plannedVariants += $noteResult['planned_variants'];
+            $changed = $changed || $noteResult['changed'];
+            $nextNotes[] = $noteResult['note'];
+        }
+
+        if ($changed && ! $dryRun && $nextNotes !== $notes) {
+            $prompt->forceFill([
+                'tool_notes' => $nextNotes,
+            ])->save();
+        }
+
+        return [
+            'changed' => $changed,
+            'generated_variants' => $generatedVariants,
+            'planned_variants' => $plannedVariants,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $note
+     * @return array{note:array<string, mixed>,changed:bool,generated_variants:int,planned_variants:int}
+     */
+    private function ensurePromptComparisonNoteVariants(array $note, bool $force, bool $dryRun): array
+    {
+        $imagePath = trim((string) ($note['image_path'] ?? ''));
+
+        if (! $this->isManagedLessonMediaPath($imagePath)) {
+            return [
+                'note' => $note,
+                'changed' => false,
+                'generated_variants' => 0,
+                'planned_variants' => 0,
+            ];
+        }
+
+        $variants = $this->ensureManagedImageVariants($imagePath, $force, $dryRun);
+        $thumbPath = $variants['thumb_path'] ?? '';
+
+        if ($thumbPath === '') {
+            $thumbPath = $imagePath;
+        }
+
+        $nextNote = $note;
+        $currentThumbPath = trim((string) ($note['thumb_path'] ?? ''));
+
+        if ($currentThumbPath !== $thumbPath) {
+            $nextNote['thumb_path'] = $thumbPath;
+            $variants['changed'] = true;
+        }
+
+        return [
+            'note' => $nextNote,
+            'changed' => (bool) $variants['changed'],
+            'generated_variants' => (int) $variants['generated_variants'],
+            'planned_variants' => (int) $variants['planned_variants'],
+        ];
+    }
+
+    /**
+     * @return array{thumb_path:string,changed:bool,generated_variants:int,planned_variants:int}
+     */
+    private function ensureManagedImageVariants(string $path, bool $force, bool $dryRun): array
+    {
+        $path = trim($path);
+
+        if (! $this->isManagedPromptPreviewPath($path) && ! $this->isManagedLessonMediaPath($path)) {
+            return [
+                'thumb_path' => '',
+                'changed' => false,
+                'generated_variants' => 0,
+                'planned_variants' => 0,
+            ];
+        }
+
+        $source = $this->openManagedImage($path);
+
+        try {
+            $generatedVariants = 0;
+            $plannedVariants = 0;
+            $changed = false;
+            $thumbPath = $path;
+
+            foreach (self::VARIANT_WIDTHS as $variant => $targetWidth) {
+                $status = $this->ensureVariantForWidth(
+                    $source['image'],
+                    $source['width'],
+                    $source['height'],
+                    $path,
+                    $variant,
+                    $targetWidth,
+                    $force,
+                    $dryRun,
+                );
+
+                if ($variant === 'thumb' && $source['width'] > $targetWidth) {
+                    $thumbPath = $this->variantPath($path, 'thumb');
+                }
+
+                if ($status === 'generated') {
+                    $generatedVariants++;
+                    $changed = true;
+                }
+
+                if ($status === 'planned') {
+                    $plannedVariants++;
+                    $changed = true;
+                }
+            }
+
+            return [
+                'thumb_path' => $thumbPath,
+                'changed' => $changed,
+                'generated_variants' => $generatedVariants,
+                'planned_variants' => $plannedVariants,
+            ];
+        } finally {
+            imagedestroy($source['image']);
+        }
+    }
+
+    /**
+     * @return array{image:\GdImage,width:int,height:int}
+     */
+    private function openManagedImage(string $path): array
+    {
+        $disk = Storage::disk($this->storageDisk());
+
+        if (! $disk->exists($path)) {
+            throw new RuntimeException(sprintf('Source image is missing: %s', $path));
+        }
+
+        $binary = $disk->get($path);
+
+        if (! is_string($binary) || $binary === '') {
+            throw new RuntimeException(sprintf('Source image could not be read: %s', $path));
+        }
+
+        $image = @imagecreatefromstring($binary);
+
+        if (! $image instanceof \GdImage) {
+            throw new RuntimeException(sprintf('Source image is not a supported raster image: %s', $path));
+        }
+
+        if (! imageistruecolor($image)) {
+            imagepalettetotruecolor($image);
+        }
+
+        imagealphablending($image, true);
+        imagesavealpha($image, true);
+
+        return [
+            'image' => $image,
+            'width' => imagesx($image),
+            'height' => imagesy($image),
+        ];
+    }
+
+    private function ensureVariantForWidth(\GdImage $source, int $sourceWidth, int $sourceHeight, string $sourcePath, string $variant, int $targetWidth, bool $force, bool $dryRun): string
+    {
+        if ($sourceWidth <= $targetWidth || $sourceWidth < 1 || $sourceHeight < 1) {
+            return 'skipped';
+        }
+
+        $variantPath = $this->variantPath($sourcePath, $variant);
+        $disk = Storage::disk($this->storageDisk());
+
+        if (! $force && $disk->exists($variantPath)) {
+            return 'skipped';
+        }
+
+        if ($dryRun) {
+            return 'planned';
+        }
+
+        $targetHeight = max(1, (int) round(($sourceHeight / $sourceWidth) * $targetWidth));
+        $canvas = imagecreatetruecolor($targetWidth, $targetHeight);
+
+        if (! $canvas instanceof \GdImage) {
+            throw new RuntimeException(sprintf('Could not allocate variant canvas for %s', $sourcePath));
+        }
+
+        imagealphablending($canvas, false);
+        imagesavealpha($canvas, true);
+        $transparent = imagecolorallocatealpha($canvas, 0, 0, 0, 127);
+        imagefilledrectangle($canvas, 0, 0, $targetWidth, $targetHeight, $transparent);
+        imagecopyresampled($canvas, $source, 0, 0, 0, 0, $targetWidth, $targetHeight, $sourceWidth, $sourceHeight);
+
+        try {
+            ob_start();
+            $converted = imagewebp($canvas, null, $this->qualityForPath($sourcePath));
+            $webpBinary = ob_get_clean();
+
+            if (! $converted || ! is_string($webpBinary) || $webpBinary === '') {
+                throw new RuntimeException(sprintf('Could not encode %s variant for %s', $variant, $sourcePath));
+            }
+
+            $disk->put($variantPath, $webpBinary, ['visibility' => 'public']);
+        } finally {
+            imagedestroy($canvas);
+        }
+
+        return 'generated';
+    }
+
+    private function variantPath(string $path, string $variant): string
+    {
+        $directory = pathinfo($path, PATHINFO_DIRNAME);
+        $filename = pathinfo($path, PATHINFO_FILENAME);
+        $baseFilename = preg_replace('/-(thumb|md)$/', '', $filename) ?? $filename;
+
+        return sprintf('%s/%s-%s.webp', $directory, $baseFilename, $variant);
+    }
+
+    private function isManagedPromptPreviewPath(string $path): bool
+    {
+        return $this->isLocalPath($path) && str_starts_with($path, self::PROMPT_PREVIEW_PREFIX . '/');
+    }
+
+    private function isManagedLessonMediaPath(string $path): bool
+    {
+        return $this->isLocalPath($path)
+            && (str_starts_with($path, 'academy/lessons/body/') || str_starts_with($path, 'academy/lessons/covers/'));
+    }
+
+    private function isLocalPath(string $path): bool
+    {
+        return $path !== ''
+            && ! str_starts_with($path, 'http://')
+            && ! str_starts_with($path, 'https://')
+            && ! str_starts_with($path, '/');
+    }
+
+    private function storageDisk(): string
+    {
+        return (string) config('uploads.object_storage.disk', 's3');
+    }
+
+    private function qualityForPath(string $path): int
+    {
+        return $this->isManagedPromptPreviewPath($path)
+            ? self::PREVIEW_WEBP_QUALITY
+            : self::LESSON_MEDIA_WEBP_QUALITY;
+    }
+}

app/Console/Commands/GenerateSitemapsCommand.php

@@ -48,13 +48,32 @@ final class GenerateSitemapsCommand extends Command
         $this->newLine();
 
         // ── Root sitemap index ────────────────────────────────────────────
+        // Write several paths so nginx `location = /sitemap.xml` and child
+        // listings stay in sync. `sitemaps/index.xml` is the canonical generated
+        // index: it is a new filename, so a scheduler user can create it even
+        // when a stale `sitemaps/sitemap.xml` is owned by another account.
         $t = microtime(true);
         $index = $build->buildIndex(force: true, persist: false, families: $families);
-        $disk->put('sitemaps/sitemap.xml', $index['content']);
+        $indexPaths = ['sitemaps/index.xml', 'sitemaps/sitemap.xml', 'sitemap.xml'];
+        $indexWritten = 0;
+
+        foreach ($indexPaths as $path) {
+            if ($this->writeXml($disk, $path, $index['content'])) {
                 $written++;
+                $indexWritten++;
+            }
+        }
+
+        if ($indexWritten === 0) {
+            $this->error('Failed to write any root sitemap index file. Check ownership of public/sitemap.xml and public/sitemaps/.');
+
+            return self::FAILURE;
+        }
+
         $this->line(sprintf(
-            '  <info>✔</info>  sitemaps/sitemap.xml  %d entries  <comment>%.3fs</comment>',
+            '  <info>✔</info>  sitemap index  %d entries  %d path(s)  <comment>%.3fs</comment>',
             $index['url_count'],
+            $indexWritten,
             microtime(true) - $t,
         ));
 
@@ -78,7 +97,12 @@ final class GenerateSitemapsCommand extends Command
                 }
 
                 $path = 'sitemaps/' . $documentName . '.xml';
-                $disk->put($path, $built['content']);
+                if (! $this->writeXml($disk, $path, $built['content'])) {
+                    $this->line(sprintf('    <fg=red>✖</>  %s  write failed', $documentName . '.xml'));
+                    $failed++;
+
+                    continue;
+                }
                 $written++;
 
                 $this->line(sprintf(
@@ -96,6 +120,40 @@ final class GenerateSitemapsCommand extends Command
             ));
         }
 
+        foreach ($build->enabledGroupIndexes() as $groupName => $groupFamilies) {
+            foreach ($groupFamilies as $family) {
+                if (! in_array($family, $families, true)) {
+                    continue 2;
+                }
+            }
+
+            $t = microtime(true);
+            $built = $build->buildNamed($groupName, force: true, persist: false);
+
+            if ($built === null) {
+                $this->line(sprintf('  <comment>–</comment>  %s.xml  <fg=red>SKIPPED</>  (group builder returned null)', $groupName));
+                $failed++;
+
+                continue;
+            }
+
+            $path = 'sitemaps/' . $groupName . '.xml';
+            if (! $this->writeXml($disk, $path, $built['content'])) {
+                $this->line(sprintf('  <fg=red>✖</>  %s.xml  write failed', $groupName));
+                $failed++;
+
+                continue;
+            }
+            $written++;
+
+            $this->line(sprintf(
+                '  <info>✔</info>  %s  %d entries  <comment>%.3fs</comment>',
+                $groupName . '.xml',
+                $built['url_count'] ?? 0,
+                microtime(true) - $t,
+            ));
+        }
+
         // ── Summary ───────────────────────────────────────────────────────
         $this->newLine();
         $this->info(sprintf(
@@ -130,4 +188,17 @@ final class GenerateSitemapsCommand extends Command
 
         return array_values(array_filter($enabled, fn (string $f): bool => in_array($f, $only, true)));
     }
+
+    private function writeXml(\Illuminate\Contracts\Filesystem\Filesystem $disk, string $path, string $content): bool
+    {
+        $ok = $disk->put($path, $content);
+
+        if ($ok !== true) {
+            $this->warn('  Could not write '.$path);
+
+            return false;
+        }
+
+        return true;
+    }
 }

app/Console/Commands/GenerateWorldWebStoriesCommand.php

@@ -0,0 +1,131 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\World;
+use App\Services\WebStories\WorldWebStoryGenerator;
+use Illuminate\Console\Command;
+use Illuminate\Validation\ValidationException;
+
+final class GenerateWorldWebStoriesCommand extends Command
+{
+    protected $signature = 'skinbase:webstories:generate
+        {world? : World ID or slug}
+        {--all : Generate stories in batch mode}
+        {--pages=7 : Number of pages to generate (5-10)}
+        {--limit=25 : Maximum worlds to process in batch mode}
+        {--force : Rebuild an existing story for the target world}
+        {--publish : Publish immediately after generation if validation passes}
+        {--dry-run : Preview generation without saving anything}';
+
+    protected $description = 'Generate standalone AMP Web Stories from Skinbase Worlds';
+
+    public function handle(WorldWebStoryGenerator $generator): int
+    {
+        $worldKey = $this->argument('world');
+        $force = (bool) $this->option('force');
+        $publish = (bool) $this->option('publish');
+        $dryRun = (bool) $this->option('dry-run');
+        $pages = max(5, min(10, (int) $this->option('pages')));
+
+        if ($worldKey !== null && trim((string) $worldKey) !== '') {
+            $world = $this->resolveWorld((string) $worldKey);
+
+            if (! $world instanceof World) {
+                $this->error(sprintf('World [%s] was not found.', (string) $worldKey));
+
+                return self::FAILURE;
+            }
+
+            return $this->generateOne($generator, $world, $pages, $force, $publish, $dryRun);
+        }
+
+        if (! (bool) $this->option('all')) {
+            $this->error('Provide a world ID/slug or pass --all for batch generation.');
+
+            return self::INVALID;
+        }
+
+        return $this->generateBatch($generator, $pages, $force, $publish, $dryRun, max(1, (int) $this->option('limit')));
+    }
+
+    private function generateOne(WorldWebStoryGenerator $generator, World $world, int $pages, bool $force, bool $publish, bool $dryRun): int
+    {
+        try {
+            $result = $generator->generateFromWorld($world, null, $pages, $force, $publish, $dryRun);
+        } catch (ValidationException $exception) {
+            foreach ($exception->errors() as $messages) {
+                foreach ($messages as $message) {
+                    $this->error((string) $message);
+                }
+            }
+
+            return self::FAILURE;
+        }
+
+        $story = $result['story'];
+        $validation = $result['validation'];
+
+        $this->info(sprintf(
+            '%s story for world [%s] -> /web-stories/%s (%d pages)',
+            $result['created'] ? 'Created' : 'Updated',
+            (string) $world->slug,
+            (string) $story->slug,
+            (int) $validation['page_count'],
+        ));
+
+        foreach ((array) $validation['warnings'] as $warning) {
+            $this->warn(' - ' . $warning);
+        }
+
+        foreach ((array) $validation['errors'] as $error) {
+            $this->error(' - ' . $error);
+        }
+
+        return $validation['valid'] || ! $publish ? self::SUCCESS : self::FAILURE;
+    }
+
+    private function generateBatch(WorldWebStoryGenerator $generator, int $pages, bool $force, bool $publish, bool $dryRun, int $limit): int
+    {
+        $processed = 0;
+        $created = 0;
+        $updated = 0;
+        $failed = 0;
+
+        $query = World::query()
+            ->published()
+            ->orderByDesc('published_at')
+            ->orderByDesc('id');
+
+        if (! $force) {
+            $query->whereDoesntHave('webStories');
+        }
+
+        $query->limit($limit)->get()->each(function (World $world) use ($generator, $pages, $force, $publish, $dryRun, &$processed, &$created, &$updated, &$failed): void {
+            $processed++;
+
+            try {
+                $result = $generator->generateFromWorld($world, null, $pages, $force, $publish, $dryRun);
+                $result['created'] ? $created++ : $updated++;
+                $this->line(sprintf('[%d] %s -> %s', (int) $world->id, (string) $world->slug, (string) $result['story']->slug));
+            } catch (ValidationException $exception) {
+                $failed++;
+                $first = collect($exception->errors())->flatten()->first();
+                $this->error(sprintf('[%d] %s failed: %s', (int) $world->id, (string) $world->slug, (string) $first));
+            }
+        });
+
+        $this->info(sprintf('Done. processed=%d created=%d updated=%d failed=%d', $processed, $created, $updated, $failed));
+
+        return $failed === 0 ? self::SUCCESS : self::FAILURE;
+    }
+
+    private function resolveWorld(string $value): ?World
+    {
+        return World::query()
+            ->when(is_numeric($value), fn ($query) => $query->where('id', (int) $value), fn ($query) => $query->where('slug', $value))
+            ->first();
+    }
+}

app/Console/Commands/HealthCheckCommand.php

@@ -5,8 +5,10 @@ declare(strict_types=1);
 namespace App\Console\Commands;
 
 use App\Models\Artwork;
+use App\Services\Sitemaps\SitemapReleaseManager;
 use App\Services\Vision\ArtworkVisionImageUrl;
 use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Redis;
@@ -25,10 +27,10 @@ use Throwable;
 class HealthCheckCommand extends Command
 {
     protected $signature = 'health:check
-        {--only= : Run only a named check (mysql|redis|cache|meilisearch|qdrant|reverb|vision|horizon|webserver|phpfpm|paths|ram|disk|load|s3|failed_jobs|queue_backlog|ssl|scheduler|log_errors|app)}
+        {--only= : Run only a named check (mysql|redis|cache|meilisearch|qdrant|reverb|vision|horizon|webserver|phpfpm|paths|ram|disk|load|s3|failed_jobs|queue_backlog|ssl|scheduler|sitemap|log_errors|app)}
         {--json  : Output results as JSON}';
 
-    protected $description = 'Check health of all critical services (MySQL, Redis, Cache, Meilisearch, Qdrant, Reverb, Vision, Horizon, Nginx, PHP-FPM, writable paths, RAM, disk, load, S3/Contabo, failed jobs, queue backlog, SSL, scheduler, log errors, App).';
+    protected $description = 'Check health of all critical services (MySQL, Redis, Cache, Meilisearch, Qdrant, Reverb, Vision, Horizon, Nginx, PHP-FPM, writable paths, RAM, disk, load, S3/Contabo, failed jobs, queue backlog, SSL, scheduler, sitemap, log errors, App).';
 
     /** Collected results: [name => [status, message, details]] */
     private array $results = [];
@@ -57,6 +59,7 @@ class HealthCheckCommand extends Command
             'queue_backlog' => fn () => $this->checkQueueBacklog(),
             'ssl'         => fn () => $this->checkSsl(),
             'scheduler'   => fn () => $this->checkScheduler(),
+            'sitemap'     => fn () => $this->checkSitemap(),
             'log_errors'  => fn () => $this->checkLogErrors(),
             'app'         => fn () => $this->checkApp(),
         ];
@@ -1041,6 +1044,51 @@ class HealthCheckCommand extends Command
         }
     }
 
+    private function checkSitemap(): void
+    {
+        try {
+            $releases = app(SitemapReleaseManager::class)->listReleases();
+
+            if ($releases === []) {
+                $this->failCheck('sitemap', 'No sitemap releases found. Run `php artisan skinbase:sitemaps:publish` to build one.');
+                return;
+            }
+
+            $latest = $releases[0];
+            $releaseId = (string) ($latest['release_id'] ?? 'unknown');
+            $builtAtRaw = (string) ($latest['built_at'] ?? $latest['published_at'] ?? '');
+
+            if ($builtAtRaw === '') {
+                $this->warn_check('sitemap', "Latest sitemap release [{$releaseId}] is missing a build timestamp.", [
+                    'release_id' => $releaseId,
+                    'status' => (string) ($latest['status'] ?? 'unknown'),
+                ]);
+                return;
+            }
+
+            $builtAt = Carbon::parse($builtAtRaw);
+            $ageSeconds = max(0, $builtAt->diffInSeconds(now()));
+            $builtAtLabel = $builtAt->toAtomString();
+            $details = [
+                'release_id' => $releaseId,
+                'built_at' => $builtAtLabel,
+                'age_seconds' => $ageSeconds,
+                'status' => (string) ($latest['status'] ?? 'unknown'),
+            ];
+            $message = "Latest sitemap release [{$releaseId}] built at {$builtAtLabel} ({$ageSeconds}s ago).";
+
+            if ($ageSeconds > 72 * 3600) {
+                $this->failCheck('sitemap', 'Sitemap build is stale — ' . $message, $details);
+            } elseif ($ageSeconds > 36 * 3600) {
+                $this->warn_check('sitemap', 'Sitemap build is getting old — ' . $message, $details);
+            } else {
+                $this->pass('sitemap', $message, $details);
+            }
+        } catch (Throwable $e) {
+            $this->warn_check('sitemap', 'Could not inspect sitemap releases: ' . $e->getMessage());
+        }
+    }
+
     private function checkLogErrors(): void
     {
         $logFile = storage_path('logs/laravel.log');

app/Console/Commands/PruneMetricSnapshotsCommand.php

@@ -7,34 +7,137 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 
 /**
- * Prune old hourly metric snapshots to prevent unbounded table growth.
+ * Prune old hourly metric snapshots in bounded batches.
  *
- * Usage:  php artisan nova:prune-metric-snapshots
+ * Usage:
- *         php artisan nova:prune-metric-snapshots --keep-days=7
+ *   php artisan nova:prune-metric-snapshots
+ *   php artisan nova:prune-metric-snapshots --keep-days=30 --chunk=5000 --dry-run
  */
 class PruneMetricSnapshotsCommand extends Command
 {
     protected $signature = 'nova:prune-metric-snapshots
-                            {--keep-days=7 : Keep snapshots for this many days}';
+                            {--keep-days= : Keep snapshots for this many days (default: config metrics.hourly_snapshot_retention_days)}
+                            {--chunk= : Rows to delete per batch (default: config metrics.hourly_snapshot_prune_chunk)}
+                            {--sleep-ms= : Pause between batches in milliseconds}
+                            {--max-batches=0 : Stop after N batches (0 = until done)}
+                            {--dry-run : Count rows that would be deleted without deleting}';
 
-    protected $description = 'Delete old hourly metric snapshots beyond the retention window';
+    protected $description = 'Delete old hourly metric snapshots beyond the retention window (batched)';
 
     public function handle(): int
     {
-        $keepDays = (int) $this->option('keep-days');
+        $keepDays = $this->resolveKeepDays();
+        $chunk = $this->resolvePositiveInt('chunk', (int) config('metrics.hourly_snapshot_prune_chunk', 5000), 1);
+        $sleepMs = $this->resolveNonNegativeInt('sleep-ms', (int) config('metrics.hourly_snapshot_prune_sleep_ms', 50));
+        $maxBatches = max(0, (int) $this->option('max-batches'));
+        $dryRun = (bool) $this->option('dry-run');
         $cutoff = now()->subDays($keepDays);
 
-        $deleted = DB::table('artwork_metric_snapshots_hourly')
+        if ($keepDays < 1) {
+            $this->error('keep-days must be >= 1.');
+
+            return self::FAILURE;
+        }
+
+        $eligible = (int) DB::table('artwork_metric_snapshots_hourly')
             ->where('bucket_hour', '<', $cutoff)
-            ->delete();
+            ->count();
 
-        $this->info("Pruned {$deleted} snapshot rows older than {$keepDays} days.");
+        $this->info(sprintf(
+            '[nova:prune-metric-snapshots] cutoff=%s keep_days=%d eligible=%d chunk=%d sleep_ms=%d max_batches=%s%s',
+            $cutoff->toDateTimeString(),
+            $keepDays,
+            $eligible,
+            $chunk,
+            $sleepMs,
+            $maxBatches === 0 ? 'unlimited' : (string) $maxBatches,
+            $dryRun ? ' (dry-run)' : ''
+        ));
 
-        Log::info('[nova:prune-metric-snapshots] completed', [
+        if ($dryRun) {
-            'deleted'   => $deleted,
+            Log::info('[nova:prune-metric-snapshots] dry-run', [
+                'eligible' => $eligible,
                 'keep_days' => $keepDays,
+                'cutoff' => $cutoff->toDateTimeString(),
             ]);
 
             return self::SUCCESS;
         }
+
+        $deleted = 0;
+        $batches = 0;
+
+        while (true) {
+            if ($maxBatches > 0 && $batches >= $maxBatches) {
+                $this->warn("Stopped after max-batches={$maxBatches}.");
+                break;
+            }
+
+            $ids = DB::table('artwork_metric_snapshots_hourly')
+                ->where('bucket_hour', '<', $cutoff)
+                ->orderBy('id')
+                ->limit($chunk)
+                ->pluck('id');
+
+            if ($ids->isEmpty()) {
+                break;
+            }
+
+            $batchDeleted = DB::table('artwork_metric_snapshots_hourly')
+                ->whereIn('id', $ids->all())
+                ->delete();
+
+            $deleted += $batchDeleted;
+            $batches++;
+
+            Log::info('[nova:prune-metric-snapshots] batch', [
+                'batch' => $batches,
+                'deleted' => $batchDeleted,
+                'deleted_total' => $deleted,
+            ]);
+
+            if ($sleepMs > 0) {
+                usleep($sleepMs * 1000);
+            }
+        }
+
+        $this->info("Pruned {$deleted} snapshot rows older than {$keepDays} days in {$batches} batch(es).");
+
+        Log::info('[nova:prune-metric-snapshots] completed', [
+            'deleted' => $deleted,
+            'batches' => $batches,
+            'keep_days' => $keepDays,
+            'cutoff' => $cutoff->toDateTimeString(),
+            'eligible_at_start' => $eligible,
+        ]);
+
+        return self::SUCCESS;
+    }
+
+    private function resolveKeepDays(): int
+    {
+        $option = $this->option('keep-days');
+
+        if ($option === null || $option === '') {
+            return (int) config('metrics.hourly_snapshot_retention_days', 30);
+        }
+
+        return (int) $option;
+    }
+
+    private function resolvePositiveInt(string $option, int $default, int $minimum): int
+    {
+        $raw = $this->option($option);
+        $value = ($raw === null || $raw === '') ? $default : (int) $raw;
+
+        return max($minimum, $value);
+    }
+
+    private function resolveNonNegativeInt(string $option, int $default): int
+    {
+        $raw = $this->option($option);
+        $value = ($raw === null || $raw === '') ? $default : (int) $raw;
+
+        return max(0, $value);
+    }
 }

app/Console/Commands/PruneOnlineVisitorIndexCommand.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Services\Traffic\OnlineVisitorRepository;
+use App\Services\Traffic\PresenceIndexPruner;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Redis;
+
+class PruneOnlineVisitorIndexCommand extends Command
+{
+    protected $signature = 'skinbase:prune-online-visitor-index
+                            {--dry-run : Count stale members without SREM}
+                            {--execute : Remove stale members}
+                            {--scan-count= : SSCAN COUNT}
+                            {--max-batches= : Batches this run}
+                            {--max-members= : Members to inspect this run}
+                            {--sleep-ms= : Pause between batches}
+                            {--time-limit= : Stop after N seconds (0 = none)}';
+
+    protected $description = 'Remove stale members from the online-visitor Redis set (SSCAN, never SMEMBERS)';
+
+    public function handle(PresenceIndexPruner $pruner): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $execute = (bool) $this->option('execute');
+        if ($dryRun === $execute) {
+            $this->error('Pass exactly one of --dry-run or --execute.');
+
+            return self::FAILURE;
+        }
+
+        $scanCount = $this->intOption('scan-count', (int) config('traffic.online_visitors.prune_scan_count', 500));
+        $maxBatches = $this->intOption('max-batches', (int) config('traffic.online_visitors.prune_max_batches', 200));
+        $maxMembers = $this->intOption('max-members', (int) config('traffic.online_visitors.prune_max_members', 100000));
+        $sleepMs = $this->intOption('sleep-ms', (int) config('traffic.online_visitors.prune_sleep_ms', 25));
+        $timeLimit = $this->intOption('time-limit', 0);
+
+        $scard = (int) Redis::scard(OnlineVisitorRepository::INDEX_KEY);
+
+        $this->info(sprintf(
+            '[prune-online-visitor-index] key=%s prefix=%s scard=%d scan_count=%d max_batches=%d max_members=%d sleep_ms=%d %s',
+            OnlineVisitorRepository::INDEX_KEY,
+            (string) config('database.redis.options.prefix'),
+            $scard,
+            $scanCount,
+            $maxBatches,
+            $maxMembers,
+            $sleepMs,
+            $dryRun ? 'dry-run' : 'execute'
+        ));
+
+        $result = $pruner->prune(
+            $scanCount,
+            $maxBatches,
+            $maxMembers,
+            $sleepMs,
+            $dryRun,
+            $timeLimit > 0 ? $timeLimit : null,
+        );
+
+        $this->info(sprintf(
+            'scanned=%d stale=%d live=%d removed=%d batches=%d',
+            $result['scanned'],
+            $result['stale'],
+            $result['live'],
+            $result['removed'],
+            $result['batches']
+        ));
+
+        Log::info('[prune-online-visitor-index] completed', $result + ['scard_before' => $scard]);
+
+        return self::SUCCESS;
+    }
+
+    private function intOption(string $name, int $default): int
+    {
+        $raw = $this->option($name);
+        if ($raw === null || $raw === '') {
+            return $default;
+        }
+
+        return max(0, (int) $raw);
+    }
+}

app/Console/Commands/PublishScheduledNewsCommand.php

@@ -7,6 +7,7 @@ namespace App\Console\Commands;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
+use App\Services\News\NewsService;
 use cPad\Plugins\News\Models\NewsArticle;
 
 final class PublishScheduledNewsCommand extends Command
@@ -17,6 +18,11 @@ final class PublishScheduledNewsCommand extends Command
 
     protected $description = 'Publish scheduled News articles whose publish time has passed.';
 
+    public function __construct(private readonly NewsService $news)
+    {
+        parent::__construct();
+    }
+
     public function handle(): int
     {
         $dryRun = (bool) $this->option('dry-run');
@@ -60,11 +66,7 @@ final class PublishScheduledNewsCommand extends Command
                         return;
                     }
 
-                    $article->forceFill([
+                    $this->news->publish($article);
-                        'editorial_status' => NewsArticle::EDITORIAL_STATUS_PUBLISHED,
-                        'status' => 'published',
-                        'published_at' => $article->published_at ?? $now,
-                    ])->save();
 
                     $published++;
                     $this->line(sprintf('Published News article #%d: "%s"', $article->id, $article->title));

app/Console/Commands/PurgeQueuedRecComputeTagsCommand.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Jobs\RecComputeSimilarByTagsJob;
+use App\Support\Queues\QueuedJobClassMatcher;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Redis;
+
+/**
+ * Deployment cleanup: remove waiting RecComputeSimilarByTagsJob payloads only.
+ *
+ * Does not run from the scheduler. Operator must pass --dry-run or --execute.
+ *
+ * Usage:
+ *   php artisan skinbase:purge-queued-rec-tags --dry-run
+ *   php artisan skinbase:purge-queued-rec-tags --execute
+ */
+class PurgeQueuedRecComputeTagsCommand extends Command
+{
+    protected $signature = 'skinbase:purge-queued-rec-tags
+                            {--queue=default : Redis queue name (waiting list only)}
+                            {--dry-run : Count matches without removing}
+                            {--execute : Remove matched waiting payloads}';
+
+    protected $description = 'Remove waiting RecComputeSimilarByTagsJob payloads from a Redis queue (opt-in)';
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $execute = (bool) $this->option('execute');
+
+        if ($dryRun === $execute) {
+            $this->error('Pass exactly one of --dry-run or --execute.');
+
+            return self::FAILURE;
+        }
+
+        $queue = (string) $this->option('queue');
+        if (! preg_match('/^[A-Za-z0-9_-]+$/', $queue)) {
+            $this->error('Invalid queue name.');
+
+            return self::FAILURE;
+        }
+
+        $key = 'queues:'.$queue;
+        $target = RecComputeSimilarByTagsJob::class;
+        $redis = Redis::connection();
+        $len = (int) $redis->llen($key);
+        $matchedPayloads = [];
+        $chunk = 200;
+
+        $this->info(sprintf(
+            '[purge-queued-rec-tags] queue=%s waiting=%d target=%s %s',
+            $queue,
+            $len,
+            $target,
+            $dryRun ? 'dry-run' : 'execute'
+        ));
+
+        for ($start = 0; $start < $len; $start += $chunk) {
+            $rows = $redis->lrange($key, $start, min($start + $chunk - 1, $len - 1));
+            foreach ($rows as $raw) {
+                if (QueuedJobClassMatcher::isClass((string) $raw, $target)) {
+                    $matchedPayloads[] = (string) $raw;
+                }
+            }
+        }
+
+        $matched = count($matchedPayloads);
+        $removed = 0;
+
+        if (! $dryRun) {
+            foreach ($matchedPayloads as $raw) {
+                $removed += (int) $redis->lrem($key, 1, $raw);
+            }
+        }
+
+        $this->info(sprintf('matched=%d removed=%d preserved_other=%s', $matched, $removed, $dryRun ? 'yes' : 'yes'));
+
+        Log::info('[purge-queued-rec-tags] completed', [
+            'queue' => $queue,
+            'waiting' => $len,
+            'matched' => $matched,
+            'removed' => $removed,
+            'dry_run' => $dryRun,
+        ]);
+
+        return self::SUCCESS;
+    }
+}

app/Console/Commands/RecalculateHeatCommand.php

@@ -57,7 +57,7 @@ class RecalculateHeatCommand extends Command
         $updatedCount = 0;
         $skippedCount = 0;
 
-        // Process in chunks using artwork IDs that have at least one snapshot in the smoothing window
+        // Distinct IDs only — do not hydrate the full 24h snapshot window in one query.
         $artworkIds = DB::table('artwork_metric_snapshots_hourly')
             ->whereBetween('bucket_hour', [$lookbackStart, $currentHour])
             ->distinct()
@@ -68,17 +68,25 @@ class RecalculateHeatCommand extends Command
             return self::SUCCESS;
         }
 
-        // Load all snapshots for the lookback window in bulk
+        foreach ($artworkIds->chunk($chunk) as $chunkIds) {
             $snapshots = DB::table('artwork_metric_snapshots_hourly')
+                ->select([
+                    'artwork_id',
+                    'bucket_hour',
+                    'views_count',
+                    'downloads_count',
+                    'favourites_count',
+                    'comments_count',
+                    'shares_count',
+                ])
                 ->whereBetween('bucket_hour', [$lookbackStart, $currentHour])
-            ->whereIn('artwork_id', $artworkIds)
+                ->whereIn('artwork_id', $chunkIds)
                 ->orderBy('bucket_hour')
                 ->get()
                 ->groupBy('artwork_id');
 
-        // Load artwork published_at dates for age factor (use published_at, fall back to created_at)
             $artworkDates = DB::table('artworks')
-            ->whereIn('id', $artworkIds)
+                ->whereIn('id', $chunkIds)
                 ->whereNull('deleted_at')
                 ->where('is_approved', true)
                 ->select('id', 'published_at', 'created_at')
@@ -87,8 +95,6 @@ class RecalculateHeatCommand extends Command
                     $row->id => \Carbon\Carbon::parse($row->published_at ?? $row->created_at),
                 ]);
 
-        // Process in chunks
-        foreach ($artworkIds->chunk($chunk) as $chunkIds) {
             $upsertRows = [];
 
             foreach ($chunkIds as $artworkId) {

app/Console/Commands/RedisCleanupLegacyPrefixCommand.php

@@ -0,0 +1,139 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+use Predis\Client as PredisClient;
+
+class RedisCleanupLegacyPrefixCommand extends Command
+{
+    protected $signature = 'skinbase:redis-cleanup-legacy-prefix
+                            {--dry-run : SCAN and report only}
+                            {--execute : UNLINK matching obsolete keys}
+                            {--max-keys=500 : Cap keys this run}';
+
+    protected $description = 'UNLINK obsolete skinbasenova-database-* and skinbasenova_horizon:* keys only';
+
+    private const LEGACY_PREFIXES = [
+        'skinbasenova-database-',
+        'skinbasenova_horizon:',
+    ];
+
+    private const PROTECTED_PREFIXES = [
+        'skinbase-database-',
+        'skinbase_horizon:',
+    ];
+
+    public function handle(): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $execute = (bool) $this->option('execute');
+        if ($dryRun === $execute) {
+            $this->error('Pass exactly one of --dry-run or --execute.');
+
+            return self::FAILURE;
+        }
+
+        $maxKeys = max(1, (int) $this->option('max-keys'));
+        $currentPrefix = (string) config('database.redis.options.prefix');
+        $horizonPrefix = (string) config('horizon.prefix');
+
+        $this->info(sprintf(
+            '[redis-cleanup-legacy-prefix] current_prefix=%s horizon_prefix=%s max_keys=%d %s',
+            $currentPrefix,
+            $horizonPrefix,
+            $maxKeys,
+            $dryRun ? 'dry-run' : 'execute'
+        ));
+
+        if (in_array($currentPrefix, self::LEGACY_PREFIXES, true) || in_array($horizonPrefix, self::LEGACY_PREFIXES, true)) {
+            $this->error('Current process still uses a legacy prefix. Aborting.');
+
+            return self::FAILURE;
+        }
+
+        $client = $this->unprefixedClient();
+        $found = [];
+        $cursor = '0';
+        do {
+            [$cursor, $keys] = $client->scan($cursor, ['COUNT' => 200, 'MATCH' => '*']);
+            foreach ($keys as $key) {
+                $key = (string) $key;
+                if ($this->isProtected($key)) {
+                    continue;
+                }
+                if (! $this->isLegacy($key)) {
+                    continue;
+                }
+                $found[] = $key;
+                if (count($found) >= $maxKeys) {
+                    $cursor = '0';
+                    break;
+                }
+            }
+        } while ($cursor !== '0' && $cursor !== 0);
+
+        $this->info('matched='.count($found));
+        foreach (array_slice($found, 0, 20) as $key) {
+            $this->line('key='.$key);
+        }
+        if (count($found) > 20) {
+            $this->line('... truncated listing');
+        }
+
+        $unlinked = 0;
+        if (! $dryRun && $found !== []) {
+            foreach (array_chunk($found, 50) as $chunk) {
+                $unlinked += (int) $client->unlink(...$chunk);
+            }
+        }
+
+        $this->info('unlinked='.$unlinked);
+
+        Log::info('[redis-cleanup-legacy-prefix] completed', [
+            'matched' => count($found),
+            'unlinked' => $unlinked,
+            'dry_run' => $dryRun,
+        ]);
+
+        return self::SUCCESS;
+    }
+
+    private function isLegacy(string $key): bool
+    {
+        foreach (self::LEGACY_PREFIXES as $prefix) {
+            if (str_starts_with($key, $prefix)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function isProtected(string $key): bool
+    {
+        foreach (self::PROTECTED_PREFIXES as $prefix) {
+            if (str_starts_with($key, $prefix)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private function unprefixedClient(): PredisClient
+    {
+        $redis = config('database.redis.default', []);
+
+        return new PredisClient([
+            'scheme' => 'tcp',
+            'host' => $redis['host'] ?? '127.0.0.1',
+            'port' => (int) ($redis['port'] ?? 6379),
+            'password' => $redis['password'] ?? null,
+            'database' => (int) ($redis['database'] ?? 0),
+        ]);
+    }
+}

app/Console/Commands/RedisCleanupOrphansCommand.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Support\Redis\OrphanQueueCleanup;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+class RedisCleanupOrphansCommand extends Command
+{
+    protected $signature = 'skinbase:redis-cleanup-orphans
+                            {target : forum-moderation, forum-security, or collections}
+                            {--dry-run : Inspect and report without UNLINK}
+                            {--execute : UNLINK the waiting queue and notify list}
+                            {--force : Allow unexpected sampled job classes}';
+
+    protected $description = 'UNLINK an orphan Redis queue after producer and class checks (operator only)';
+
+    public function handle(OrphanQueueCleanup $cleanup): int
+    {
+        $dryRun = (bool) $this->option('dry-run');
+        $execute = (bool) $this->option('execute');
+        if ($dryRun === $execute) {
+            $this->error('Pass exactly one of --dry-run or --execute.');
+
+            return self::FAILURE;
+        }
+
+        $target = (string) $this->argument('target');
+        $force = (bool) $this->option('force');
+
+        $this->info(sprintf(
+            '[redis-cleanup-orphans] prefix=%s connection=default target=%s force=%s mode=%s',
+            (string) config('database.redis.options.prefix'),
+            $target,
+            $force ? 'yes' : 'no',
+            $dryRun ? 'dry-run' : 'execute'
+        ));
+
+        try {
+            $plan = $execute
+                ? $cleanup->execute($target, $force)
+                : $cleanup->plan($target, $force);
+        } catch (RuntimeException $e) {
+            $this->error($e->getMessage());
+            Log::warning('[redis-cleanup-orphans] refused', ['target' => $target, 'error' => $e->getMessage()]);
+
+            return self::FAILURE;
+        }
+
+        $this->line('logical_key='.$plan['logical_key']);
+        $this->line('notify_key='.$plan['notify_key']);
+        $this->line('llen='.$plan['llen'].' reserved='.$plan['reserved'].' delayed='.$plan['delayed']);
+        $this->line('sampled='.$plan['sampled'].' est_bytes='.$plan['est_bytes']);
+        $this->line('classes='.json_encode($plan['classes']));
+        if ($plan['unexpected_classes'] !== []) {
+            $this->warn('unexpected_classes='.json_encode($plan['unexpected_classes']));
+        }
+        if ($plan['errors'] !== []) {
+            $this->error('errors='.implode(',', $plan['errors']));
+        }
+        if ($execute) {
+            $this->info('unlinked='.($plan['unlinked'] ?? 0));
+        }
+
+        Log::info('[redis-cleanup-orphans] completed', [
+            'target' => $target,
+            'dry_run' => $dryRun,
+            'llen' => $plan['llen'],
+            'errors' => $plan['errors'],
+            'unlinked' => $plan['unlinked'] ?? 0,
+        ]);
+
+        return ($plan['errors'] === [] || $dryRun) ? self::SUCCESS : self::FAILURE;
+    }
+}

app/Console/Commands/SecurityReportScanCommand.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Notifications\SecurityReportDangerNotification;
+use App\Services\SecurityReport\SecurityReportScanner;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Notification;
+
+final class SecurityReportScanCommand extends Command
+{
+    protected $signature = 'security:scan
+        {--notify : Send configured email notification when high or critical findings exist}
+        {--triggered-by=artisan : Mark the scan source}
+        {--user-id= : Associate the scan with a specific user id}';
+
+    protected $description = 'Run Composer and npm security audits and store a private admin report.';
+
+    public function handle(SecurityReportScanner $scanner): int
+    {
+        if (! (bool) config('security-report.enabled', true)) {
+            $this->warn('Security report scanning is disabled.');
+
+            return self::INVALID;
+        }
+
+        $this->info('Running security report scan...');
+
+        $report = $scanner->scan(
+            (string) $this->option('triggered-by'),
+            $this->option('user-id') !== null ? (int) $this->option('user-id') : null,
+        );
+
+        if ($report->status === 'failed') {
+            $this->error('Security scan failed: ' . (string) ($report->error_message ?? 'Unknown error'));
+
+            return self::FAILURE;
+        }
+
+        $this->table(
+            ['Status', 'Critical', 'High', 'Medium', 'Low', 'Unknown', 'Composer outdated', 'npm outdated'],
+            [[
+                $report->status,
+                $report->total_critical,
+                $report->total_high,
+                $report->total_medium,
+                $report->total_low,
+                $report->total_unknown,
+                $report->composer_outdated_count,
+                $report->npm_outdated_count,
+            ]],
+        );
+
+        if ((bool) $this->option('notify') && $report->hasDangerFindings()) {
+            $this->sendDangerNotification($report);
+            $this->info('Danger notification sent.');
+        }
+
+        if ($report->hasCriticalFindings() && (bool) config('security-report.fail_on.critical', false)) {
+            return self::FAILURE;
+        }
+
+        if ($report->hasHighFindings() && (bool) config('security-report.fail_on.high', false)) {
+            return self::FAILURE;
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function sendDangerNotification(\App\Models\SecurityReport $report): void
+    {
+        $email = trim((string) config('security-report.notify_email', ''));
+
+        if ($email === '') {
+            return;
+        }
+
+        Notification::route('mail', $email)
+            ->notify(new SecurityReportDangerNotification($report));
+    }
+}

app/Console/Commands/ValidateWorldWebStoriesCommand.php

@@ -0,0 +1,163 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Models\WorldWebStory;
+use App\Services\WebStories\WorldWebStoryValidationService;
+use Illuminate\Console\Command;
+use Symfony\Component\Process\Process;
+
+final class ValidateWorldWebStoriesCommand extends Command
+{
+    protected $signature = 'skinbase:webstories:validate
+        {story? : Story ID or slug}
+        {--published : Limit batch mode to published stories}
+        {--visible : Limit batch mode to publicly visible stories}
+        {--limit=100 : Maximum stories to validate in batch mode}
+        {--amp : Also run amphtml-validator against the public story URL}
+        {--fail-warnings : Treat validation warnings as failures}';
+
+    protected $description = 'Validate World Web Stories for publish safety and optional AMP validity';
+
+    public function handle(WorldWebStoryValidationService $validation): int
+    {
+        $storyKey = $this->argument('story');
+
+        if ($storyKey !== null && trim((string) $storyKey) !== '') {
+            $story = $this->resolveStory((string) $storyKey);
+
+            if (! $story instanceof WorldWebStory) {
+                $this->error(sprintf('Web story [%s] was not found.', (string) $storyKey));
+
+                return self::FAILURE;
+            }
+
+            return $this->validateOne($validation, $story);
+        }
+
+        return $this->validateBatch($validation, max(1, (int) $this->option('limit')));
+    }
+
+    private function validateOne(WorldWebStoryValidationService $validation, WorldWebStory $story): int
+    {
+        $result = $validation->validate($story);
+        $ampErrors = $this->ampErrors($story);
+
+        $this->line(sprintf('Story [%d] %s', (int) $story->id, (string) $story->slug));
+
+        foreach ((array) $result['warnings'] as $warning) {
+            $this->warn(' - ' . $warning);
+        }
+
+        foreach ((array) $result['errors'] as $error) {
+            $this->error(' - ' . $error);
+        }
+
+        foreach ($ampErrors as $ampError) {
+            $this->error(' - AMP: ' . $ampError);
+        }
+
+        if ($result['valid'] && $ampErrors === []) {
+            $this->info('Validation passed.');
+
+            return self::SUCCESS;
+        }
+
+        return self::FAILURE;
+    }
+
+    private function validateBatch(WorldWebStoryValidationService $validation, int $limit): int
+    {
+        $processed = 0;
+        $failed = 0;
+
+        $this->storyQuery()
+            ->limit($limit)
+            ->get()
+            ->each(function (WorldWebStory $story) use ($validation, &$processed, &$failed): void {
+                $processed++;
+                $result = $validation->validate($story);
+                $ampErrors = $this->ampErrors($story);
+                $warningsFail = (bool) $this->option('fail-warnings') && count((array) $result['warnings']) > 0;
+                $hasFailure = ! $result['valid'] || $warningsFail || $ampErrors !== [];
+
+                if ($hasFailure) {
+                    $failed++;
+                }
+
+                $this->line(sprintf('[%d] %s -> %s', (int) $story->id, (string) $story->slug, $hasFailure ? 'invalid' : 'valid'));
+
+                foreach ((array) $result['warnings'] as $warning) {
+                    $this->warn(' - ' . $warning);
+                }
+
+                foreach ((array) $result['errors'] as $error) {
+                    $this->error(' - ' . $error);
+                }
+
+                foreach ($ampErrors as $ampError) {
+                    $this->error(' - AMP: ' . $ampError);
+                }
+            });
+
+        $this->info(sprintf('Done. processed=%d failed=%d', $processed, $failed));
+
+        return $failed === 0 ? self::SUCCESS : self::FAILURE;
+    }
+
+    private function storyQuery()
+    {
+        return WorldWebStory::query()
+            ->when((bool) $this->option('published'), fn ($query) => $query->published())
+            ->when((bool) $this->option('visible'), fn ($query) => $query->visible())
+            ->orderByDesc('published_at')
+            ->orderByDesc('id');
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function ampErrors(WorldWebStory $story): array
+    {
+        if (! (bool) $this->option('amp')) {
+            return [];
+        }
+
+        if (! $story->exists || ! $story->publicUrl()) {
+            return ['Story has no public URL to validate.'];
+        }
+
+        $probe = new Process(['npx', 'amphtml-validator', '--version'], base_path(), null, null, 60);
+        $probe->run();
+
+        if (! $probe->isSuccessful()) {
+            return ['amphtml-validator is not available via npx.'];
+        }
+
+        $process = new Process(['npx', 'amphtml-validator', $story->publicUrl()], base_path(), null, null, 120);
+        $process->run();
+
+        if ($process->isSuccessful()) {
+            return [];
+        }
+
+        $output = trim($process->getErrorOutput() ?: $process->getOutput());
+
+        if ($output === '') {
+            return ['AMP validator failed without output.'];
+        }
+
+        $lines = preg_split('/\r\n|\r|\n/', $output);
+
+        return $lines === false || $lines === [] ? ['AMP validator failed.'] : $lines;
+    }
+
+    private function resolveStory(string $value): ?WorldWebStory
+    {
+        return WorldWebStory::query()
+            ->when(is_numeric($value), fn ($query) => $query->where('id', (int) $value), fn ($query) => $query->where('slug', $value))
+            ->first();
+    }
+}

app/Console/Kernel.php

@@ -31,10 +31,13 @@ use App\Console\Commands\PublishScheduledArtworksCommand;
 use App\Console\Commands\PublishScheduledNewsCommand;
 use App\Console\Commands\PublishScheduledNovaCardsCommand;
 use App\Console\Commands\BuildSitemapsCommand;
+use App\Console\Commands\BuildWorldWebStoryAssetsCommand;
 use App\Console\Commands\ListSitemapReleasesCommand;
+use App\Console\Commands\GenerateWorldWebStoriesCommand;
 use App\Console\Commands\PublishSitemapsCommand;
 use App\Console\Commands\RollbackSitemapReleaseCommand;
 use App\Console\Commands\SyncCollectionLifecycleCommand;
+use App\Console\Commands\ValidateWorldWebStoriesCommand;
 use App\Console\Commands\ValidateSitemapsCommand;
 use App\Console\Commands\AuditArtworkDownloadFilesCommand;
 use App\Console\Commands\InspectArtworkOriginalCommand;
@@ -58,6 +61,9 @@ class Kernel extends ConsoleKernel
         \App\Console\Commands\ResetAllUserPasswords::class,
         CleanupUploadsCommand::class,
         BuildSitemapsCommand::class,
+        GenerateWorldWebStoriesCommand::class,
+        BuildWorldWebStoryAssetsCommand::class,
+        ValidateWorldWebStoriesCommand::class,
         PublishSitemapsCommand::class,
         ListSitemapReleasesCommand::class,
         RollbackSitemapReleaseCommand::class,

app/Contracts/Moderation/CommentSpamClassifier.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Contracts\Moderation;
+
+use App\Data\Moderation\CommentSpamClassification;
+
+interface CommentSpamClassifier
+{
+    public function classify(string $content): CommentSpamClassification;
+}

app/Data/Moderation/CommentSpamClassification.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Data\Moderation;
+
+final class CommentSpamClassification
+{
+    public function __construct(
+        public readonly bool $spam,
+        public readonly float $confidence,
+        public readonly string $reason,
+        public readonly string $provider,
+        public readonly string $model,
+        public readonly int $latencyMs,
+    ) {}
+}

app/Http/Controllers/Academy/AcademyAnalyticsEventController.php

@@ -0,0 +1,94 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Academy;
+
+use App\Http\Controllers\Controller;
+use App\Services\Academy\AcademyAnalyticsContentResolver;
+use App\Services\Academy\AcademyAnalyticsService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
+use App\Support\AcademyAnalytics\AcademyAnalyticsEventType;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+
+final class AcademyAnalyticsEventController extends Controller
+{
+    public function __construct(
+        private readonly AcademyAnalyticsService $analytics,
+        private readonly AcademyAnalyticsContentResolver $resolver,
+    ) {
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+        abort_unless($request->expectsJson() || $request->isJson(), 422);
+
+        $validated = $request->validate([
+            'event_type' => ['required', 'string', Rule::in(AcademyAnalyticsEventType::values())],
+            'content_type' => ['nullable', 'string', Rule::in(AcademyAnalyticsContentType::values())],
+            'content_id' => ['nullable', 'integer', 'min:1'],
+            'metadata' => ['nullable', 'array'],
+            'visitor_id' => ['nullable', 'string', 'max:120'],
+            'session_id' => ['nullable', 'string', 'max:120'],
+            'url' => ['nullable', 'string', 'max:4000'],
+            'route_name' => ['nullable', 'string', 'max:255'],
+            'referrer' => ['nullable', 'string', 'max:4000'],
+            'utm_source' => ['nullable', 'string', 'max:255'],
+            'utm_medium' => ['nullable', 'string', 'max:255'],
+            'utm_campaign' => ['nullable', 'string', 'max:255'],
+        ]);
+
+        if (isset($validated['metadata']) && strlen((string) json_encode($validated['metadata'])) > 8192) {
+            return response()->json([
+                'message' => 'Metadata payload is too large.',
+            ], 422);
+        }
+
+        $contentType = $validated['content_type'] ?? null;
+        $contentId = $validated['content_id'] ?? null;
+
+        if ($contentType !== null && AcademyAnalyticsContentType::requiresContentId($contentType) && $contentId === null) {
+            return response()->json([
+                'message' => 'content_id is required for this content type.',
+            ], 422);
+        }
+
+        if ($contentType !== null && $contentId !== null && ! $this->resolver->exists($contentType, (int) $contentId)) {
+            return response()->json([
+                'message' => 'Unknown Academy analytics content target.',
+            ], 422);
+        }
+
+        if (($validated['event_type'] ?? null) === AcademyAnalyticsEventType::SEARCH_RESULT_CLICK) {
+            validator([
+                'content_type' => $contentType,
+                'content_id' => $contentId,
+                'metadata' => $validated['metadata'] ?? [],
+            ], [
+                'content_type' => ['required', 'string', Rule::in([
+                    AcademyAnalyticsContentType::PROMPT,
+                    AcademyAnalyticsContentType::LESSON,
+                    AcademyAnalyticsContentType::COURSE,
+                    AcademyAnalyticsContentType::PROMPT_PACK,
+                    AcademyAnalyticsContentType::CHALLENGE,
+                ])],
+                'content_id' => ['required', 'integer', 'min:1'],
+                'metadata.query' => ['required', 'string', 'max:120'],
+                'metadata.normalized_query' => ['required', 'string', 'max:120'],
+                'metadata.results_count' => ['required', 'integer', 'min:0'],
+                'metadata.position' => ['nullable', 'integer', 'min:1'],
+                'metadata.source' => ['nullable', 'string', 'max:120'],
+                'metadata.filters' => ['nullable', 'array'],
+            ])->validate();
+        }
+
+        $this->analytics->track($validated, $request->user(), $request);
+
+        return response()->json([
+            'ok' => true,
+        ]);
+    }
+}

app/Http/Controllers/Academy/AcademyBillingController.php

@@ -0,0 +1,741 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Academy;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyBillingPlanService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
+use App\Support\Seo\SeoFactory;
+use Laravel\Cashier\Checkout;
+use Laravel\Cashier\Subscription;
+use Stripe\Exception\InvalidRequestException;
+use Illuminate\Support\Facades\Log;
+
+use App\Mail\AcademyAccessIssue;
+use App\Models\StaffApplication;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+final class AcademyBillingController extends Controller
+{
+    public function __construct(
+        private readonly AcademyAccessService $access,
+        private readonly AcademyBillingPlanService $plans,
+    ) {}
+
+    public function pricing(\Illuminate\Http\Request $request): \Inertia\Response
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+
+        $this->plans->assertConfigured();
+
+        /** @var User|null $user */
+        $user = $request->user();
+        $canonical = \route('academy.pricing');
+        $seo = \app(SeoFactory::class)
+            ->collectionPage(
+                'Skinbase AI Academy Pricing — Skinbase',
+                'Compare Skinbase AI Academy Creator and Pro tiers, start free, and manage premium access through Stripe billing.',
+                $canonical,
+            )
+            ->toArray();
+
+        $seo['og_type'] = 'website';
+        $activePlan = $user instanceof User ? $this->activePlan($user) : null;
+
+        return \Inertia\Inertia::render('Academy/Billing/Pricing', [
+            'seo' => $seo,
+            'billingEnabled' => $this->plans->enabled(),
+            'currentTier' => $this->access->currentTier($user),
+            'isSubscribed' => $user instanceof User ? $this->access->hasActiveAcademySubscription($user) : false,
+            'activePlanKey' => $activePlan['key'] ?? null,
+            'activePlanLabel' => $activePlan['label'] ?? null,
+            'catalog' => $this->catalog(),
+            'missingRemote' => $this->plans->missingRemotePriceIds(),
+            'links' => [
+                'login' => \route('login'),
+                'pricing' => \route('academy.pricing'),
+                'billingAccount' => $user ? \route('academy.billing.account') : null,
+                'checkout' => $user ? \route('academy.billing.checkout') : null,
+            ],
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::UPGRADE,
+                'contentId' => null,
+                'eventUrl' => \route('academy.analytics.events.store'),
+                'pageName' => 'academy_billing_pricing',
+                'isPremium' => false,
+                'isGuest' => $user === null,
+                'isSubscriber' => $user?->hasAcademyCreatorAccess() || $user?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
+    }
+
+    public function checkout(\Illuminate\Http\Request $request): Checkout|\Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+
+        if (! $this->plans->enabled()) {
+            return $this->billingDisabledResponse($request, 'Academy billing is not enabled yet.');
+        }
+
+        $this->plans->assertConfigured();
+
+        $user = $request->user();
+
+        if (! $user instanceof User) {
+            return \redirect()->route('login');
+        }
+
+        if ($user->email_verified_at === null) {
+            throw \Illuminate\Validation\ValidationException::withMessages([
+                'plan' => 'Verify your email address before starting Academy billing.',
+            ]);
+        }
+
+        $validated = $request->validate([
+            'plan' => ['required', 'string'],
+        ]);
+
+        $plan = $this->plans->plan((string) $validated['plan']);
+
+        if ($plan === null) {
+            throw \Illuminate\Validation\ValidationException::withMessages([
+                'plan' => 'Select a valid Academy billing plan.',
+            ]);
+        }
+
+        if (! ($plan['configured'] ?? false)) {
+            return $this->missingPriceIdResponse($request, (string) $plan['key']);
+        }
+
+        if (! ($plan['price_id_valid'] ?? false)) {
+            return $this->invalidPriceIdResponse($request, (string) $plan['key']);
+        }
+
+        if ($this->access->hasActiveAcademySubscription($user)) {
+            // If the user already has an Academy subscription, allow an in-place upgrade
+            // (e.g. Creator -> Pro) by swapping the subscription to the requested price.
+            $subscription = $this->academySubscription($user);
+            $currentPlan = $this->activePlan($user);
+
+            // If current plan exists and the requested plan ranks higher, perform swap.
+            if ($currentPlan !== null && ($this->planRank((string) $plan['tier']) > $this->planRank((string) $currentPlan['tier']))) {
+                try {
+                    if ($subscription instanceof Subscription) {
+                        $subscription->swap((string) $plan['stripe_price_id']);
+                    }
+
+                    return \redirect()->route('academy.billing.account')->with('success', 'Subscription upgraded — your new plan is active.');
+                } catch (\Throwable $e) {
+                    $context = [
+                        'user_id' => $user->id ?? null,
+                        'user_email' => $user->email ?? null,
+                        'stripe_id' => $user->stripe_id ?? null,
+                        'route' => 'academy.billing.checkout',
+                        'attempt' => 'swap_subscription',
+                        'plan_key' => $plan['key'] ?? null,
+                        'plan_price_id' => $plan['stripe_price_id'] ?? null,
+                        'request_ip' => $request->ip(),
+                        'user_agent' => $request->header('User-Agent'),
+                        'exception_class' => \get_class($e),
+                        'exception_message' => $e->getMessage(),
+                        'exception_code' => $e->getCode(),
+                        'exception_trace' => \method_exists($e, 'getTraceAsString') ? $e->getTraceAsString() : null,
+                    ];
+
+                    if (method_exists($e, 'getStripeCode')) {
+                        $context['stripe_code'] = $e->getStripeCode();
+                    }
+
+                    Log::error('Academy billing: failed to swap subscription for upgrade', $context);
+
+                    return $this->checkoutErrorResponse($request, $e);
+                }
+            }
+
+            return \redirect()->route('academy.billing.portal');
+        }
+
+        try {
+            return $user
+                ->newSubscription($this->plans->subscriptionName(), (string) $plan['stripe_price_id'])
+                ->withMetadata([
+                    'skinbase_module' => 'academy',
+                    'user_id' => (string) $user->id,
+                    'academy_plan' => (string) $plan['key'],
+                    'academy_tier' => (string) $plan['tier'],
+                ])
+                ->checkout([
+                    'success_url' => \route('academy.billing.success').'?session_id={CHECKOUT_SESSION_ID}',
+                    'cancel_url' => \route('academy.billing.cancel'),
+                    'allow_promotion_codes' => true,
+                    'metadata' => [
+                        'skinbase_module' => 'academy',
+                        'user_id' => (string) $user->id,
+                        'academy_plan' => (string) $plan['key'],
+                        'academy_tier' => (string) $plan['tier'],
+                    ],
+                ]);
+        } catch (InvalidRequestException $e) {
+            // Stripe returned a request error (e.g. missing/deleted customer). Try to recover once by
+            // clearing stored `stripe_id`, recreating the customer in Stripe and retrying the checkout.
+            if (str_contains($e->getMessage(), 'No such customer')) {
+                try {
+                    $user->forceFill(['stripe_id' => null])->save();
+
+                    // Create a fresh Stripe customer and persist the id
+                    if (method_exists($user, 'createAsStripeCustomer')) {
+                        $user->createAsStripeCustomer();
+                    } else {
+                        // fallback to createOrGet behavior
+                        $user->createOrGetStripeCustomer();
+                    }
+
+                    return $user
+                        ->newSubscription($this->plans->subscriptionName(), (string) $plan['stripe_price_id'])
+                        ->withMetadata([
+                            'skinbase_module' => 'academy',
+                            'user_id' => (string) $user->id,
+                            'academy_plan' => (string) $plan['key'],
+                            'academy_tier' => (string) $plan['tier'],
+                        ])
+                        ->checkout([
+                            'success_url' => \route('academy.billing.success').'?session_id={CHECKOUT_SESSION_ID}',
+                            'cancel_url' => \route('academy.billing.cancel'),
+                            'allow_promotion_codes' => true,
+                            'metadata' => [
+                                'skinbase_module' => 'academy',
+                                'user_id' => (string) $user->id,
+                                'academy_plan' => (string) $plan['key'],
+                                'academy_tier' => (string) $plan['tier'],
+                            ],
+                        ]);
+                } catch (\Throwable $inner) {
+                    $context = [
+                        'user_id' => $user->id ?? null,
+                        'user_email' => $user->email ?? null,
+                        'stripe_id' => $user->stripe_id ?? null,
+                        'route' => 'academy.billing.checkout',
+                        'attempt' => 'recreate_customer_and_checkout',
+                        'plan_key' => $plan['key'] ?? null,
+                        'plan_price_id' => $plan['stripe_price_id'] ?? null,
+                        'request_ip' => $request->ip(),
+                        'user_agent' => $request->header('User-Agent'),
+                        'exception_class' => \get_class($inner),
+                        'exception_message' => $inner->getMessage(),
+                        'exception_code' => $inner->getCode(),
+                        'exception_trace' => \method_exists($inner, 'getTraceAsString') ? $inner->getTraceAsString() : null,
+                    ];
+
+                    if (method_exists($inner, 'getStripeCode')) {
+                        $context['stripe_code'] = $inner->getStripeCode();
+                    }
+
+                    Log::error('Academy billing: failed to recover Stripe customer and start checkout', $context);
+
+                    return $this->checkoutErrorResponse($request, $inner);
+                }
+            }
+
+            // Not a recoverable customer-missing error; rethrow to be handled below
+            throw $e;
+        } catch (\Throwable $exception) {
+            $context = [
+                'user_id' => $user->id ?? null,
+                'user_email' => $user->email ?? null,
+                'stripe_id' => $user->stripe_id ?? null,
+                'route' => 'academy.billing.checkout',
+                'attempt' => 'start_checkout',
+                'plan_key' => $plan['key'] ?? null,
+                'plan_price_id' => $plan['stripe_price_id'] ?? null,
+                'request_ip' => $request->ip(),
+                'user_agent' => $request->header('User-Agent'),
+                'exception_class' => \get_class($exception),
+                'exception_message' => $exception->getMessage(),
+                'exception_code' => $exception->getCode(),
+                'exception_trace' => \method_exists($exception, 'getTraceAsString') ? $exception->getTraceAsString() : null,
+            ];
+
+            if (method_exists($exception, 'getStripeCode')) {
+                $context['stripe_code'] = $exception->getStripeCode();
+            }
+
+            Log::error('Academy billing: unexpected error starting checkout', $context);
+
+            return $this->checkoutErrorResponse($request, $exception);
+        }
+    }
+
+    public function checkoutLegacy(\Illuminate\Http\Request $request, string $plan): Checkout|\Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        $request->merge([
+            'plan' => $this->plans->normalizePlanKey($plan),
+        ]);
+
+        return $this->checkout($request);
+    }
+
+    public function portal(\Illuminate\Http\Request $request): \Illuminate\Http\RedirectResponse
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+        \abort_unless($this->plans->enabled(), 404);
+
+        /** @var User|null $user */
+        $user = $request->user();
+
+        if (! $user instanceof User || \blank($user->stripe_id)) {
+            return \redirect()->route('academy.billing.account')->with('error', 'No Stripe billing profile is connected to this account yet.');
+        }
+
+        try {
+            return $user->redirectToBillingPortal(\route('academy.billing.account'));
+        } catch (\Exception $e) {
+            // If the Stripe customer was deleted or invalid, attempt a recovery similar to checkout.
+            if ($e instanceof \Stripe\Exception\InvalidRequestException && str_contains($e->getMessage(), 'No such customer')) {
+                try {
+                    $user->forceFill(['stripe_id' => null])->save();
+
+                    if (method_exists($user, 'createAsStripeCustomer')) {
+                        $user->createAsStripeCustomer();
+                    } else {
+                        $user->createOrGetStripeCustomer();
+                    }
+
+                    return $user->redirectToBillingPortal(\route('academy.billing.account'));
+                } catch (\Throwable $inner) {
+                    $context = [
+                        'user_id' => $user->id ?? null,
+                        'user_email' => $user->email ?? null,
+                        'stripe_id' => $user->stripe_id ?? null,
+                        'route' => 'academy.billing.portal',
+                        'attempt' => 'recreate_customer_and_redirect',
+                        'request_ip' => $request->ip(),
+                        'user_agent' => $request->header('User-Agent'),
+                        'exception_class' => \get_class($inner),
+                        'exception_message' => $inner->getMessage(),
+                        'exception_code' => $inner->getCode(),
+                        'exception_trace' => \method_exists($inner, 'getTraceAsString') ? $inner->getTraceAsString() : null,
+                    ];
+
+                    if (method_exists($inner, 'getStripeCode')) {
+                        $context['stripe_code'] = $inner->getStripeCode();
+                    }
+
+                    Log::error('Academy billing: failed to recover Stripe customer and open billing portal', $context);
+
+                    return \redirect()->route('academy.billing.account')->with('error', 'Could not open the subscription manager. Please email [email protected] with your account details and checkout session id if available.');
+                }
+            }
+
+            $context = [
+                'user_id' => $user->id ?? null,
+                'user_email' => $user->email ?? null,
+                'stripe_id' => $user->stripe_id ?? null,
+                'route' => 'academy.billing.portal',
+                'attempt' => 'redirect_to_portal',
+                'request_ip' => $request->ip(),
+                'user_agent' => $request->header('User-Agent'),
+                'exception_class' => \get_class($e),
+                'exception_message' => $e->getMessage(),
+                'exception_code' => $e->getCode(),
+                'exception_trace' => \method_exists($e, 'getTraceAsString') ? $e->getTraceAsString() : null,
+            ];
+
+            if (method_exists($e, 'getStripeCode')) {
+                $context['stripe_code'] = $e->getStripeCode();
+            }
+
+            Log::error('Academy billing: could not open Stripe billing portal', $context);
+
+            return \redirect()->route('academy.billing.account')->with('error', 'Could not open the subscription manager. Please email [email protected] with your account details and checkout session id if available.');
+        }
+    }
+
+    public function success(\Illuminate\Http\Request $request): \Inertia\Response
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+
+        /** @var User|null $user */
+        $user = $request->user();
+        $currentTier = $this->access->currentTier($user);
+        $seo = \app(SeoFactory::class)
+            ->simplePage(
+                'Academy Subscription Confirmed — Skinbase',
+                'Payment confirmation for your Skinbase Academy subscription.',
+                \route('academy.billing.success'),
+                false,
+            )
+            ->toArray();
+
+        return \Inertia\Inertia::render('Academy/Billing/Success', [
+            'seo' => $seo,
+            'message' => 'Payment is being confirmed. Your access will update automatically.',
+            'currentTier' => $currentTier,
+            'isSubscribed' => $user instanceof User ? $this->access->hasActiveAcademySubscription($user) : false,
+            'links' => [
+                'pricing' => \route('academy.pricing'),
+                'account' => $user ? \route('academy.billing.account') : null,
+                'academy' => \route('academy.index'),
+                'reportIssue' => $user ? \route('academy.billing.report_issue') : null,
+            ],
+            'sessionId' => $request->query('session_id'),
+        ])->rootView('academy');
+    }
+
+    public function cancel(): \Inertia\Response
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+        $seo = \app(SeoFactory::class)
+            ->simplePage(
+                'Academy Billing Canceled — Skinbase',
+                'Checkout was canceled before starting a Skinbase Academy subscription.',
+                \route('academy.billing.cancel'),
+                false,
+            )
+            ->toArray();
+
+        return \Inertia\Inertia::render('Academy/Billing/Cancel', [
+            'seo' => $seo,
+            'message' => 'Checkout was canceled. No payment was made.',
+            'links' => [
+                'pricing' => \route('academy.pricing'),
+                'academy' => \route('academy.index'),
+            ],
+        ])->rootView('academy');
+    }
+    
+        public function reportIssue(\Illuminate\Http\Request $request): \Illuminate\Http\RedirectResponse
+        {
+            /** @var User|null $user */
+            $user = $request->user();
+
+            if (! $user instanceof User) {
+                return redirect()->route('login');
+            }
+
+            $validated = $request->validate([
+                'message' => ['nullable', 'string', 'max:2000'],
+                'session_id' => ['nullable', 'string'],
+                'issue_type' => ['nullable', 'string', 'in:billing,payment,upgrade,downgrade,cancel,access,other'],
+                'contact_email' => ['nullable', 'email:rfc', 'max:255'],
+            ]);
+
+            $payload = [
+                'id' => (string) Str::uuid(),
+                'submitted_at' => now()->toISOString(),
+                'ip' => $request->ip(),
+                'user_agent' => $request->userAgent(),
+                'data' => [
+                    'topic' => 'contact',
+                    'name' => (string) ($user->name ?: $user->username ?: 'Academy billing user'),
+                    'email' => (string) ($validated['contact_email'] ?? $user->email),
+                    'message' => $validated['message'] ?? null,
+                    'issue_type' => $validated['issue_type'] ?? 'billing',
+                    'session_id' => $validated['session_id'] ?? $request->query('session_id'),
+                    'source' => 'academy_billing',
+                    'user_id' => (string) $user->id,
+                    'account_email' => (string) $user->email,
+                    'current_url' => $request->fullUrl(),
+                ],
+            ];
+
+            try {
+                try {
+                    Storage::append('staff_applications.jsonl', json_encode($payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
+                } catch (\Throwable $e) {
+                    // best-effort store; do not fail the user when file storage is unavailable
+                }
+
+                $application = null;
+
+                try {
+                    $application = StaffApplication::create([
+                        'id' => $payload['id'],
+                        'topic' => 'contact',
+                        'name' => $payload['data']['name'],
+                        'email' => $payload['data']['email'],
+                        'role' => 'academy_billing_support',
+                        'portfolio' => null,
+                        'message' => $payload['data']['message'],
+                        'payload' => $payload,
+                        'ip' => $payload['ip'],
+                        'user_agent' => $payload['user_agent'],
+                    ]);
+                } catch (\Throwable $e) {
+                    // ignore DB errors and fall back to a lightweight model for mail
+                }
+
+                $to = config('mail.from.address');
+
+                if ($to) {
+                    if (! $application) {
+                        $application = new StaffApplication([
+                            'topic' => 'contact',
+                            'name' => $payload['data']['name'],
+                            'email' => $payload['data']['email'],
+                            'role' => 'academy_billing_support',
+                            'message' => $payload['data']['message'],
+                            'payload' => $payload,
+                            'ip' => $payload['ip'],
+                            'user_agent' => $payload['user_agent'],
+                        ]);
+                        $application->id = $payload['id'];
+                        $application->created_at = now();
+                    }
+
+                    Mail::to($to)->send(new AcademyAccessIssue(
+                        $user,
+                        $payload['data']['message'] ?? null,
+                        $payload['data']['session_id'] ?? null,
+                        $payload['data']['issue_type'] ?? null,
+                        $payload['data']['email'] ?? null,
+                    ));
+                }
+
+                return redirect()->back()->with('success', 'Support request sent — we will verify and activate your access shortly.');
+            } catch (\Throwable $e) {
+                report($e);
+
+                return redirect()->back()->with('error', 'Could not send the support request. Please try again later or email [email protected].');
+            }
+        }
+
+    public function account(\Illuminate\Http\Request $request): \Inertia\Response
+    {
+        \abort_unless((bool) \config('academy.enabled', true), 404);
+        \abort_unless($this->plans->enabled(), 404);
+
+        /** @var User $user */
+        $user = $request->user();
+        $subscription = $this->academySubscription($user);
+        $seo = \app(SeoFactory::class)
+            ->simplePage(
+                'Academy Subscription Account — Skinbase',
+                'Manage your Skinbase Academy subscription and billing access.',
+                \route('academy.billing.account'),
+                false,
+            )
+            ->toArray();
+
+        $activePlan = $this->activePlan($user);
+
+        return \Inertia\Inertia::render('Academy/Billing/Account', [
+            'seo' => $seo,
+            'currentTier' => $this->access->currentTier($user),
+            'isSubscribed' => $this->access->hasActiveAcademySubscription($user),
+            'activePlan' => $activePlan ? [
+                'key' => $activePlan['key'],
+                'label' => $activePlan['label'],
+                'price_display' => $activePlan['price_display'] ?? null,
+                'tier' => $activePlan['tier'],
+            ] : null,
+            'subscription' => $subscription ? [
+                'name' => $subscription->type,
+                'status' => $subscription->stripe_status,
+                'active' => $subscription->active(),
+                'onGracePeriod' => $subscription->onGracePeriod(),
+                'endsAt' => $subscription->ends_at?->toISOString(),
+                'priceIds' => $subscription->items->pluck('stripe_price')->filter()->values()->all(),
+            ] : null,
+            'links' => [
+                'portal' => \route('academy.billing.portal'),
+                'pricing' => \route('academy.pricing'),
+                'academy' => \route('academy.index'),
+                'checkout' => \route('academy.billing.checkout'),
+                'reportIssue' => \route('academy.billing.report_issue'),
+            ],
+        ])->rootView('academy');
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function catalog(): array
+    {
+        $definitions = [
+            'creator' => [
+                'name' => 'Creator',
+                'description' => 'Entry premium access for prompt systems, creator lessons, and saved Academy workflows.',
+                'badge' => 'Paid',
+                'featured' => false,
+                'features' => [
+                    'Creator lessons and walkthroughs',
+                    'Full Creator prompt templates',
+                    'Prompt save and reuse flows',
+                    'Upgrade path into Pro later',
+                ],
+            ],
+            'pro' => [
+                'name' => 'Pro',
+                'description' => 'Full Academy access across Creator and Pro lessons, prompts, and future premium drops.',
+                'badge' => 'Recommended',
+                'featured' => true,
+                'features' => [
+                    'Everything in Creator',
+                    'Advanced Pro lessons and prompt systems',
+                    'Priority access to future Academy premium features',
+                    'Stripe billing portal for upgrades and invoices',
+                ],
+            ],
+        ];
+
+        return collect($definitions)
+            ->map(function (array $definition, string $tier): array {
+                $plan = $this->plans->plan($tier.'_monthly');
+
+                $plans = $plan !== null ? [[
+                    'key' => $plan['key'],
+                    'label' => $plan['label'],
+                    'interval' => $plan['interval'],
+                    'amount' => $plan['amount'],
+                    'currency' => $plan['currency'],
+                    'price_display' => $plan['price_display'],
+                    'configured' => $plan['configured'],
+                    'price_id_valid' => $plan['price_id_valid'],
+                    'remote_price_exists' => $plan['remote_price_exists'] ?? false,
+                ]] : [];
+
+                return [
+                    'tier' => $tier,
+                    'name' => $definition['name'],
+                    'description' => $definition['description'],
+                    'badge' => $definition['badge'],
+                    'featured' => $definition['featured'],
+                    'features' => $definition['features'],
+                    'plans' => $plans,
+                ];
+            })
+            ->values()
+            ->all();
+    }
+
+    private function academySubscription(User $user): ?Subscription
+    {
+        $subscription = $user->subscription($this->plans->subscriptionName());
+
+        return $subscription instanceof Subscription
+            ? $subscription->loadMissing('items')
+            : null;
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    private function activePlan(User $user): ?array
+    {
+        $subscription = $this->academySubscription($user);
+
+        if (! $subscription instanceof Subscription || (! $subscription->active() && ! $subscription->onGracePeriod())) {
+            return null;
+        }
+
+        $matchedPlan = null;
+
+        foreach ($subscription->items as $item) {
+            $priceId = trim((string) $item->stripe_price);
+
+            if ($priceId === '') {
+                continue;
+            }
+
+            $plan = $this->plans->planForPriceId($priceId);
+
+            if ($plan === null) {
+                continue;
+            }
+
+            if ($matchedPlan === null || $this->planRank((string) $plan['tier']) > $this->planRank((string) $matchedPlan['tier'])) {
+                $matchedPlan = $plan;
+            }
+        }
+
+        if ($matchedPlan !== null) {
+            return $matchedPlan;
+        }
+
+        $fallbackPriceId = trim((string) $subscription->stripe_price);
+
+        return $fallbackPriceId !== '' ? $this->plans->planForPriceId($fallbackPriceId) : null;
+    }
+
+    private function planRank(string $tier): int
+    {
+        return match (strtolower(trim($tier))) {
+            'admin' => 40,
+            'pro' => 30,
+            'creator' => 20,
+            default => 10,
+        };
+    }
+
+    private function billingDisabledResponse(\Illuminate\Http\Request $request, string $message): \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        $payload = [
+            'ok' => false,
+            'code' => 'academy_payments_disabled',
+            'message' => $message,
+        ];
+
+        if ($request->expectsJson()) {
+            return \response()->json($payload, 423);
+        }
+
+        return \redirect()->route('academy.pricing')->with('error', $message);
+    }
+
+    private function missingPriceIdResponse(\Illuminate\Http\Request $request, string $planKey): \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        $message = 'The selected Academy plan is not configured yet. Please try again later.';
+
+        if ($request->expectsJson()) {
+            return \response()->json([
+                'ok' => false,
+                'code' => 'academy_billing_price_missing',
+                'message' => $message,
+                'plan' => $planKey,
+            ], 422);
+        }
+
+        return \redirect()->route('academy.pricing')->with('error', $message);
+    }
+
+    private function invalidPriceIdResponse(\Illuminate\Http\Request $request, string $planKey): \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        $message = 'The selected Academy plan is misconfigured. Please contact support before continuing.';
+
+        if ($request->expectsJson()) {
+            return \response()->json([
+                'ok' => false,
+                'code' => 'academy_billing_price_invalid',
+                'message' => $message,
+                'plan' => $planKey,
+            ], 422);
+        }
+
+        return \redirect()->route('academy.pricing')->with('error', $message);
+    }
+
+    private function checkoutErrorResponse(\Illuminate\Http\Request $request, \Throwable $exception): \Illuminate\Http\JsonResponse|\Illuminate\Http\RedirectResponse
+    {
+        $message = 'Academy checkout could not be started right now.';
+
+        if (app()->hasDebugModeEnabled() && trim($exception->getMessage()) !== '') {
+            $message .= ' '.$exception->getMessage();
+        }
+
+        if ($request->expectsJson()) {
+            return \response()->json([
+                'ok' => false,
+                'code' => 'academy_billing_checkout_failed',
+                'message' => $message,
+            ], 422);
+        }
+
+        return \redirect()->route('academy.pricing')->with('error', $message);
+    }
+}

app/Http/Controllers/Academy/AcademyChallengeController.php

@@ -7,7 +7,10 @@ namespace App\Http\Controllers\Academy;
 use App\Http\Controllers\Controller;
 use App\Models\AcademyChallenge;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyInteractionService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
@@ -15,7 +18,10 @@ use Inertia\Response;
 
 final class AcademyChallengeController extends Controller
 {
-    public function __construct(private readonly AcademyAccessService $access)
+    public function __construct(
+        private readonly AcademyAccessService $access,
+        private readonly AcademyInteractionService $interactions,
+    )
     {
     }
 
@@ -39,6 +45,13 @@ final class AcademyChallengeController extends Controller
                 route('academy.challenges.index'),
             )
             ->toArray();
+        $seo = SeoDataBuilder::fromArray($seo)
+            ->breadcrumbs([
+                ['name' => 'Academy', 'url' => route('academy.index')],
+                ['name' => 'Challenges', 'url' => route('academy.challenges.index')],
+            ])
+            ->build()
+            ->toArray();
 
         return Inertia::render('Academy/List', [
             'pageType' => 'challenges',
@@ -49,7 +62,17 @@ final class AcademyChallengeController extends Controller
             'filters' => [],
             'categories' => [],
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => null,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_challenges_index',
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 
     public function show(Request $request, string $slug): Response
@@ -79,12 +102,26 @@ final class AcademyChallengeController extends Controller
             'submitted_at' => $submission->submitted_at?->toISOString(),
         ])->values()->all();
 
-        $seo = app(SeoFactory::class)->collectionPage(
+        $canonical = route('academy.challenges.show', ['slug' => $challenge->slug]);
+        $description = Str::limit((string) ($challenge->excerpt ?? $challenge->description ?? ''), 160, '...');
+        $seo = SeoDataBuilder::fromArray(
+            app(SeoFactory::class)->collectionPage(
                 $challenge->title . ' — Skinbase Academy',
-            Str::limit((string) ($challenge->excerpt ?? $challenge->description ?? ''), 160, '...'),
+                $description,
-            route('academy.challenges.show', ['slug' => $challenge->slug]),
+                $canonical,
                 $challenge->cover_image,
-        )->toArray();
+            )->toArray()
+        )
+            ->breadcrumbs([
+                ['name' => 'Academy', 'url' => route('academy.index')],
+                ['name' => 'Challenges', 'url' => route('academy.challenges.index')],
+                ['name' => (string) $challenge->title, 'url' => $canonical],
+            ])
+            ->addJsonLd($this->challengeStructuredData($payload, $canonical, $description))
+            ->build()
+            ->toArray();
+
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::CHALLENGE, (int) $challenge->id);
 
         return Inertia::render('Academy/Show', [
             'pageType' => 'challenge',
@@ -92,6 +129,65 @@ final class AcademyChallengeController extends Controller
             'seo' => $seo,
             'pricingUrl' => route('academy.pricing'),
             'submitUrl' => $request->user() ? route('academy.challenges.submit', ['slug' => $challenge->slug]) : null,
-        ])->rootView('collections');
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::CHALLENGE,
+                'contentId' => (int) $challenge->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_challenge_show',
+                'isPremium' => (string) ($challenge->access_level ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => (bool) ($payload['locked'] ?? false),
+            ],
+        ])->rootView('academy');
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function challengeStructuredData(array $payload, string $canonical, string $description): array
+    {
+        $image = trim((string) ($payload['cover_image'] ?? ''));
+        $imageUrl = $image !== '' && preg_match('/^https?:\/\//i', $image) === 1 ? $image : ($image !== '' ? url($image) : null);
+        $requiredTags = array_values((array) ($payload['required_tags'] ?? []));
+        $status = strtolower(trim((string) ($payload['status'] ?? '')));
+        $eventStatus = match ($status) {
+            'scheduled' => 'https://schema.org/EventScheduled',
+            'active', 'voting' => 'https://schema.org/EventInProgress',
+            'completed', 'archived' => 'https://schema.org/EventCompleted',
+            default => null,
+        };
+
+        return array_filter([
+            '@context' => 'https://schema.org',
+            '@type' => 'Event',
+            'name' => (string) ($payload['title'] ?? 'Skinbase Academy challenge'),
+            'description' => $description,
+            'url' => $canonical,
+            'image' => $imageUrl,
+            'startDate' => $payload['starts_at'] ?? null,
+            'endDate' => $payload['ends_at'] ?? null,
+            'eventStatus' => $eventStatus,
+            'eventAttendanceMode' => 'https://schema.org/OnlineEventAttendanceMode',
+            'location' => [
+                '@type' => 'VirtualLocation',
+                'url' => $canonical,
+            ],
+            'organizer' => [
+                '@type' => 'Organization',
+                'name' => config('seo.site_name', 'Skinbase'),
+                'url' => url('/'),
+            ],
+            'keywords' => $requiredTags !== [] ? $requiredTags : null,
+            'isAccessibleForFree' => (string) ($payload['access_level'] ?? 'free') === 'free',
+        ], fn (mixed $value): bool => $value !== null && $value !== '' && $value !== []);
     }
 }

app/Http/Controllers/Academy/AcademyChallengeSubmissionController.php

@@ -35,6 +35,8 @@ final class AcademyChallengeSubmissionController extends Controller
             'Submit to ' . $challenge->title . ' — Skinbase Academy',
             'Attach one of your artworks to this Academy challenge submission.',
             route('academy.challenges.submit', ['slug' => $challenge->slug]),
+            null,
+            false,
         )->toArray();
 
         return Inertia::render('Academy/ChallengeSubmit', [
@@ -47,7 +49,7 @@ final class AcademyChallengeSubmissionController extends Controller
                 'published_at' => $artwork->published_at?->toISOString(),
             ])->values()->all(),
             'submitUrl' => route('academy.challenges.submit.store', ['slug' => $challenge->slug]),
-        ])->rootView('collections');
+        ])->rootView('academy');
     }
 
     public function store(StoreAcademyChallengeSubmissionRequest $request, string $slug): RedirectResponse

app/Http/Controllers/Academy/AcademyCourseController.php

@@ -8,10 +8,13 @@ use App\Http\Controllers\Controller;
 use App\Models\AcademyCourse;
 use App\Models\AcademyCourseLesson;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyInteractionService;
 use App\Services\Academy\AcademyCacheService;
 use App\Services\Academy\AcademyCourseNavigationService;
 use App\Services\Academy\AcademyCourseProgressService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
 use Inertia\Response;
@@ -23,6 +26,7 @@ final class AcademyCourseController extends Controller
         private readonly AcademyCacheService $cache,
         private readonly AcademyCourseNavigationService $navigation,
         private readonly AcademyCourseProgressService $progress,
+        private readonly AcademyInteractionService $interactions,
     ) {
     }
 
@@ -34,6 +38,7 @@ final class AcademyCourseController extends Controller
             'difficulty' => ['nullable', 'string', 'max:40'],
             'access' => ['nullable', 'string', 'max:40'],
         ]);
+        $hasActiveFilters = filled($filters['difficulty'] ?? null) || filled($filters['access'] ?? null);
 
         $query = AcademyCourse::query()->published()->ordered();
 
@@ -74,6 +79,13 @@ final class AcademyCourseController extends Controller
             )
             ->toArray();
 
+        if ($hasActiveFilters) {
+            $seo = SeoDataBuilder::fromArray($seo)
+                ->indexable(false)
+                ->build()
+                ->toArray();
+        }
+
         return Inertia::render('Academy/CoursesIndex', [
             'seo' => $seo,
             'title' => 'Academy courses',
@@ -82,7 +94,24 @@ final class AcademyCourseController extends Controller
             'featuredCourses' => $featuredCourses->all(),
             'filters' => $filters,
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'lessonsUrl' => route('academy.lessons.index'),
+            'promptLibraryUrl' => route('academy.prompts.index'),
+            'academyAccess' => array_merge($this->access->accessSummary($request->user()), [
+                'billingUrl' => $request->user() && (bool) config('academy_billing.enabled', false)
+                    ? route('academy.billing.account')
+                    : route('academy.pricing'),
+            ]),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => null,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_courses_index',
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 
     public function show(Request $request, AcademyCourse $course): Response
@@ -172,6 +201,8 @@ final class AcademyCourseController extends Controller
             )
             ->toArray();
 
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::COURSE, (int) $course->id);
+
         return Inertia::render('Academy/CoursesShow', [
             'seo' => $seo,
             'course' => $coursePayload,
@@ -179,6 +210,23 @@ final class AcademyCourseController extends Controller
             'unsectionedLessons' => $unsectionedLessons,
             'pricingUrl' => route('academy.pricing'),
             'startUrl' => $request->user() ? route('academy.courses.start', ['course' => $course->slug]) : null,
-        ])->rootView('collections');
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::COURSE,
+                'contentId' => (int) $course->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_course_show',
+                'isPremium' => (string) ($course->access_level ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => false,
+            ],
+        ])->rootView('academy');
     }
 }

app/Http/Controllers/Academy/AcademyCourseEnrollmentController.php

@@ -6,14 +6,17 @@ namespace App\Http\Controllers\Academy;
 
 use App\Http\Controllers\Controller;
 use App\Models\AcademyCourse;
+use App\Services\Academy\AcademyProgressService;
 use App\Services\Academy\AcademyCourseProgressService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 
 final class AcademyCourseEnrollmentController extends Controller
 {
-    public function __construct(private readonly AcademyCourseProgressService $progress)
+    public function __construct(
-    {
+        private readonly AcademyCourseProgressService $progress,
+        private readonly AcademyProgressService $academyProgress,
+    ) {
     }
 
     public function start(Request $request, AcademyCourse $course): RedirectResponse
@@ -21,7 +24,7 @@ final class AcademyCourseEnrollmentController extends Controller
         abort_unless((bool) config('academy.enabled', true), 404);
         abort_unless($course->isPublished(), 404);
 
-        $this->progress->markEnrollmentStarted($request->user(), $course);
+        $this->academyProgress->startCourse($request->user(), (int) $course->id, $request);
         $continueLesson = $this->progress->getContinueLesson($request->user(), $course);
 
         if ($continueLesson?->lesson) {

app/Http/Controllers/Academy/AcademyCourseLessonController.php

@@ -8,9 +8,12 @@ use App\Http\Controllers\Controller;
 use App\Models\AcademyCourse;
 use App\Models\AcademyLesson;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyInteractionService;
 use App\Services\Academy\AcademyCourseNavigationService;
 use App\Services\Academy\AcademyCourseProgressService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
 use Illuminate\Support\Str;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -22,6 +25,7 @@ final class AcademyCourseLessonController extends Controller
         private readonly AcademyAccessService $access,
         private readonly AcademyCourseNavigationService $navigation,
         private readonly AcademyCourseProgressService $progress,
+        private readonly AcademyInteractionService $interactions,
     ) {
     }
 
@@ -49,7 +53,7 @@ final class AcademyCourseLessonController extends Controller
             ->all();
 
         $payload = $this->access->courseLessonPayload($courseLesson, $request->user(), true);
-        $canonical = route('academy.courses.lessons.show', ['course' => $course->slug, 'lesson' => $lesson->slug]);
+        $canonical = route('academy.lessons.show', ['slug' => $lesson->slug]);
         $description = Str::limit(trim((string) ($lesson->seo_description ?? $lesson->excerpt ?? 'Skinbase Academy course lesson.')), 160, '...');
         $seo = app(SeoFactory::class)->academyLessonPage(
             (string) ($lesson->seo_title ?? ($lesson->title . ' — ' . $course->title)),
@@ -67,6 +71,12 @@ final class AcademyCourseLessonController extends Controller
             $lesson->updated_at?->toAtomString(),
             (string) $course->title,
         )->toArray();
+        $seo = SeoDataBuilder::fromArray($seo)
+            ->indexable(false)
+            ->build()
+            ->toArray();
+
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::LESSON, (int) $lesson->id);
 
         return Inertia::render('Academy/Show', [
             'pageType' => 'lesson',
@@ -79,6 +89,26 @@ final class AcademyCourseLessonController extends Controller
             'pricingUrl' => route('academy.pricing'),
             'completeUrl' => $request->user() ? route('academy.lessons.complete', ['lesson' => $lesson->id]) : null,
             'completed' => $request->user()?->academyLessonProgress()->where('lesson_id', $lesson->id)->whereNotNull('completed_at')->exists() ?? false,
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'progressRoutes' => [
+                'startLesson' => $request->user() ? route('academy.progress.lesson.start') : null,
+            ],
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::LESSON,
+                'contentId' => (int) $lesson->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_course_lesson_show',
+                'isPremium' => (string) ($payload['access_level'] ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => (bool) ($payload['locked'] ?? false),
+            ],
             'courseContext' => [
                 'id' => (int) $course->id,
                 'title' => (string) $course->title,
@@ -94,6 +124,6 @@ final class AcademyCourseLessonController extends Controller
                 ],
                 'outline' => $courseOutline,
             ],
-        ])->rootView('collections');
+        ])->rootView('academy');
     }
 }

app/Http/Controllers/Academy/AcademyHomeController.php

@@ -11,6 +11,7 @@ use App\Models\AcademyLesson;
 use App\Models\AcademyPromptTemplate;
 use App\Services\Academy\AcademyAccessService;
 use App\Services\Academy\AcademyCacheService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
 use Illuminate\Http\Request;
 use Inertia\Inertia;
@@ -59,10 +60,16 @@ final class AcademyHomeController extends Controller
         return Inertia::render('Academy/Index', [
             'seo' => $seo,
             'pricingUrl' => route('academy.pricing'),
+            'academyAccess' => array_merge($this->access->accessSummary($request->user()), [
+                'billingUrl' => $request->user() && (bool) config('academy_billing.enabled', false)
+                    ? route('academy.billing.account')
+                    : route('academy.pricing'),
+            ]),
             'links' => [
                 'lessons' => route('academy.lessons.index'),
                 'courses' => route('academy.courses.index'),
                 'prompts' => route('academy.prompts.index'),
+                'promptPopular' => route('academy.prompts.popular'),
                 'packs' => route('academy.packs.index'),
                 'challenges' => route('academy.challenges.index'),
             ],
@@ -81,6 +88,16 @@ final class AcademyHomeController extends Controller
             'featuredLessons' => collect($home['featuredLessons'])->map(fn (AcademyLesson $lesson): array => $this->access->lessonPayload($lesson, $request->user()))->values()->all(),
             'featuredPrompts' => collect($home['featuredPrompts'])->map(fn (AcademyPromptTemplate $prompt): array => $this->access->promptPayload($prompt, $request->user()))->values()->all(),
             'featuredChallenges' => collect($home['featuredChallenges'])->map(fn (AcademyChallenge $challenge): array => $this->access->challengePayload($challenge, $request->user(), true))->values()->all(),
-        ])->rootView('collections');
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::HOME,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_home',
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 }

app/Http/Controllers/Academy/AcademyInteractionController.php

@@ -0,0 +1,67 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Academy;
+
+use App\Http\Controllers\Controller;
+use App\Services\Academy\AcademyInteractionService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use InvalidArgumentException;
+
+final class AcademyInteractionController extends Controller
+{
+    public function __construct(private readonly AcademyInteractionService $interactions)
+    {
+    }
+
+    public function like(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $this->validatePayload($request);
+
+        try {
+            $payload = $this->interactions->toggleLike($request->user(), (string) $validated['content_type'], (int) $validated['content_id'], $request);
+        } catch (InvalidArgumentException $exception) {
+            return response()->json(['message' => $exception->getMessage()], 422);
+        }
+
+        return response()->json($payload);
+    }
+
+    public function save(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $this->validatePayload($request);
+
+        try {
+            $payload = $this->interactions->toggleSave($request->user(), (string) $validated['content_type'], (int) $validated['content_id'], $request);
+        } catch (InvalidArgumentException $exception) {
+            return response()->json(['message' => $exception->getMessage()], 422);
+        }
+
+        return response()->json($payload);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function validatePayload(Request $request): array
+    {
+        return $request->validate([
+            'content_type' => ['required', 'string', Rule::in([
+                AcademyAnalyticsContentType::PROMPT,
+                AcademyAnalyticsContentType::LESSON,
+                AcademyAnalyticsContentType::COURSE,
+                AcademyAnalyticsContentType::PROMPT_PACK,
+                AcademyAnalyticsContentType::CHALLENGE,
+            ])],
+            'content_id' => ['required', 'integer', 'min:1'],
+        ]);
+    }
+}

app/Http/Controllers/Academy/AcademyLessonController.php

@@ -8,8 +8,13 @@ use App\Http\Controllers\Controller;
 use App\Models\AcademyCourse;
 use App\Models\AcademyLesson;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyAnalyticsService;
 use App\Services\Academy\AcademyCacheService;
+use App\Services\Academy\AcademyInteractionService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
@@ -20,9 +25,11 @@ final class AcademyLessonController extends Controller
     public function __construct(
         private readonly AcademyAccessService $access,
         private readonly AcademyCacheService $cache,
+        private readonly AcademyAnalyticsService $analytics,
+        private readonly AcademyInteractionService $interactions,
     ) {}
 
-    public function index(Request $request): Response
+    public function index(Request $request): Response|JsonResponse
     {
         abort_unless((bool) config('academy.enabled', true), 404);
 
@@ -31,6 +38,9 @@ final class AcademyLessonController extends Controller
             'category' => ['nullable', 'string', 'max:140'],
             'difficulty' => ['nullable', 'string', 'max:40'],
         ]);
+        $hasActiveFilters = filled($filters['q'] ?? null)
+            || filled($filters['category'] ?? null)
+            || filled($filters['difficulty'] ?? null);
 
         $query = AcademyLesson::query()
             ->with('category')
@@ -56,6 +66,14 @@ final class AcademyLessonController extends Controller
         $lessons = $query->paginate(12)->withQueryString();
         $lessons->getCollection()->transform(fn (AcademyLesson $lesson): array => $this->access->lessonPayload($lesson, $request->user()));
 
+        if (filled($filters['q'] ?? null)) {
+            $this->analytics->trackSearch((string) $filters['q'], (int) $lessons->total(), array_filter($filters), $request);
+        }
+
+        if ($request->expectsJson()) {
+            return response()->json($lessons);
+        }
+
         $seo = app(SeoFactory::class)
             ->collectionListing(
                 'Academy Lessons — Skinbase',
@@ -64,16 +82,48 @@ final class AcademyLessonController extends Controller
             )
             ->toArray();
 
+        if ($hasActiveFilters) {
+            $seo = SeoDataBuilder::fromArray($seo)
+                ->indexable(false)
+                ->build()
+                ->toArray();
+        }
+
         return Inertia::render('Academy/List', [
             'pageType' => 'lessons',
             'title' => 'Academy lessons',
             'description' => 'Step-by-step tutorials and workflow guides for AI-assisted creative work on Skinbase.',
             'seo' => $seo,
+            'breadcrumbs' => [
+                ['label' => 'Academy', 'href' => route('academy.index')],
+                ['label' => 'Lessons', 'href' => route('academy.lessons.index')],
+            ],
             'items' => $lessons,
             'filters' => $filters,
             'categories' => $this->cache->categoriesByType('lesson'),
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'coursesUrl' => route('academy.courses.index'),
+            'promptLibraryUrl' => route('academy.prompts.index'),
+            'academyAccess' => array_merge($this->access->accessSummary($request->user()), [
+                'billingUrl' => $request->user() && (bool) config('academy_billing.enabled', false)
+                    ? route('academy.billing.account')
+                    : route('academy.pricing'),
+            ]),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => filled($filters['q'] ?? null) ? AcademyAnalyticsContentType::SEARCH : null,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_lessons_index',
+                'search' => filled($filters['q'] ?? null) ? [
+                    'query' => (string) $filters['q'],
+                    'resultsCount' => (int) $lessons->total(),
+                ] : null,
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 
     public function show(Request $request, string $slug): Response
@@ -148,6 +198,8 @@ final class AcademyLessonController extends Controller
             (string) ($lesson->series_name ?: $lesson->category?->name ?: 'Academy'),
         )->toArray();
 
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::LESSON, (int) $lesson->id);
+
         return Inertia::render('Academy/Show', [
             'pageType' => 'lesson',
             'item' => $payload,
@@ -159,6 +211,26 @@ final class AcademyLessonController extends Controller
             'pricingUrl' => route('academy.pricing'),
             'completeUrl' => $request->user() ? route('academy.lessons.complete', ['lesson' => $lesson->id]) : null,
             'completed' => $request->user()?->academyLessonProgress()->where('lesson_id', $lesson->id)->whereNotNull('completed_at')->exists() ?? false,
-        ])->rootView('collections');
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'progressRoutes' => [
+                'startLesson' => $request->user() ? route('academy.progress.lesson.start') : null,
+            ],
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::LESSON,
+                'contentId' => (int) $lesson->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_lesson_show',
+                'isPremium' => (string) ($lesson->access_level ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => (bool) ($payload['locked'] ?? false),
+            ],
+        ])->rootView('academy');
     }
 }

app/Http/Controllers/Academy/AcademyPricingController.php

@@ -5,13 +5,15 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Academy;
 
 use App\Http\Controllers\Controller;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use Illuminate\Http\Request;
 use Inertia\Inertia;
 use Inertia\Response;
 
 final class AcademyPricingController extends Controller
 {
-    public function index(): Response
+    public function index(Request $request): Response
     {
         abort_unless((bool) config('academy.enabled', true), 404);
 
@@ -67,6 +69,16 @@ final class AcademyPricingController extends Controller
                     ],
                 ],
             ],
-        ])->rootView('collections');
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::UPGRADE,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_pricing',
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 }

app/Http/Controllers/Academy/AcademyProgressController.php

@@ -20,6 +20,32 @@ final class AcademyProgressController extends Controller
     ) {
     }
 
+    public function startLesson(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $request->validate([
+            'lesson_id' => ['required', 'integer', 'min:1'],
+            'course_id' => ['nullable', 'integer', 'min:1'],
+        ]);
+
+        $lesson = AcademyLesson::query()->findOrFail((int) $validated['lesson_id']);
+        abort_unless($this->access->canAccessLesson($request->user(), $lesson), 403);
+
+        $courseId = $request->filled('course_id') ? (int) $validated['course_id'] : null;
+        if ($courseId !== null) {
+            $course = AcademyCourse::query()->published()->findOrFail($courseId);
+            abort_unless($course->courseLessons()->where('lesson_id', $lesson->id)->exists(), 403);
+        }
+
+        $record = $this->progress->startLesson($request->user(), (int) $lesson->id, $courseId, $request);
+
+        return response()->json([
+            'ok' => true,
+            'status' => (string) $record->status,
+        ]);
+    }
+
     public function complete(Request $request, AcademyLesson $lesson): JsonResponse
     {
         abort_unless((bool) config('academy.enabled', true), 404);
@@ -31,7 +57,7 @@ final class AcademyProgressController extends Controller
             $course = AcademyCourse::query()->published()->find($request->integer('course_id'));
         }
 
-        $record = $this->progress->markLessonComplete($request->user(), $lesson, $course);
+        $record = $this->progress->markLessonComplete($request->user(), $lesson, $course, $request);
 
         return response()->json([
             'ok' => true,
@@ -39,4 +65,55 @@ final class AcademyProgressController extends Controller
             'completed_at' => $record->completed_at?->toISOString(),
         ]);
     }
+
+    public function completeLesson(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $request->validate([
+            'lesson_id' => ['required', 'integer', 'min:1'],
+            'course_id' => ['nullable', 'integer', 'min:1'],
+        ]);
+
+        $lesson = AcademyLesson::query()->findOrFail((int) $validated['lesson_id']);
+
+        return $this->complete($request, $lesson);
+    }
+
+    public function startCourse(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $request->validate([
+            'course_id' => ['required', 'integer', 'min:1'],
+        ]);
+
+        $course = AcademyCourse::query()->published()->findOrFail((int) $validated['course_id']);
+        $record = $this->progress->startCourse($request->user(), (int) $course->id, $request);
+
+        return response()->json([
+            'ok' => true,
+            'status' => (string) $record->status,
+            'progress_percent' => (int) $record->progress_percent,
+        ]);
+    }
+
+    public function completeCourse(Request $request): JsonResponse
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $request->validate([
+            'course_id' => ['required', 'integer', 'min:1'],
+        ]);
+
+        $course = AcademyCourse::query()->published()->findOrFail((int) $validated['course_id']);
+        $record = $this->progress->completeCourse($request->user(), (int) $course->id, $request);
+
+        return response()->json([
+            'ok' => true,
+            'status' => (string) $record->status,
+            'progress_percent' => (int) $record->progress_percent,
+            'completed' => (string) $record->status === 'completed',
+        ]);
+    }
 }

app/Http/Controllers/Academy/AcademyPromptController.php

@@ -7,10 +7,17 @@ namespace App\Http\Controllers\Academy;
 use App\Http\Controllers\Controller;
 use App\Models\AcademyPromptTemplate;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyAnalyticsService;
 use App\Services\Academy\AcademyCacheService;
+use App\Services\Academy\AcademyInteractionService;
+use App\Services\Academy\AcademyPopularityService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
 use Illuminate\Http\Request;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Support\Str;
+use Illuminate\Support\Facades\DB;
 use Inertia\Inertia;
 use Inertia\Response;
 
@@ -19,10 +26,13 @@ final class AcademyPromptController extends Controller
     public function __construct(
         private readonly AcademyAccessService $access,
         private readonly AcademyCacheService $cache,
+        private readonly AcademyAnalyticsService $analytics,
+        private readonly AcademyInteractionService $interactions,
+        private readonly AcademyPopularityService $popularity,
     ) {
     }
 
-    public function index(Request $request): Response
+    public function index(Request $request): Response|JsonResponse
     {
         abort_unless((bool) config('academy.enabled', true), 404);
 
@@ -32,6 +42,10 @@ final class AcademyPromptController extends Controller
             'difficulty' => ['nullable', 'string', 'max:40'],
             'tag' => ['nullable', 'string', 'max:60'],
         ]);
+        $hasActiveFilters = filled($filters['q'] ?? null)
+            || filled($filters['category'] ?? null)
+            || filled($filters['difficulty'] ?? null)
+            || filled($filters['tag'] ?? null);
 
         $query = AcademyPromptTemplate::query()
             ->with('category')
@@ -62,6 +76,14 @@ final class AcademyPromptController extends Controller
         $prompts = $query->paginate(12)->withQueryString();
         $prompts->getCollection()->transform(fn (AcademyPromptTemplate $prompt): array => $this->access->promptPayload($prompt, $request->user()));
 
+        if (filled($filters['q'] ?? null)) {
+            $this->analytics->trackSearch((string) $filters['q'], (int) $prompts->total(), array_filter($filters), $request);
+        }
+
+        if ($request->expectsJson()) {
+            return response()->json($prompts);
+        }
+
         $seo = app(SeoFactory::class)
             ->collectionListing(
                 'Academy Prompts — Skinbase',
@@ -70,16 +92,240 @@ final class AcademyPromptController extends Controller
             )
             ->toArray();
 
+        if ($hasActiveFilters) {
+            $seo = SeoDataBuilder::fromArray($seo)
+                ->indexable(false)
+                ->build()
+                ->toArray();
+        }
+
         return Inertia::render('Academy/List', [
             'pageType' => 'prompts',
+            'promptView' => 'library',
             'title' => 'Prompt library',
             'description' => 'Reusable prompt templates for wallpapers, worlds, mascots, covers, and digital art workflows.',
             'seo' => $seo,
+            'breadcrumbs' => [
+                ['label' => 'Academy', 'href' => route('academy.index')],
+                ['label' => 'Prompt Library', 'href' => route('academy.prompts.index')],
+            ],
             'items' => $prompts,
             'filters' => $filters,
             'categories' => $this->cache->categoriesByType('prompt'),
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'coursesUrl' => route('academy.courses.index'),
+            'packsUrl' => route('academy.packs.index'),
+            'promptPopularUrl' => route('academy.prompts.popular'),
+            'promptLibraryUrl' => route('academy.prompts.index'),
+            'academyAccess' => array_merge($this->access->accessSummary($request->user()), [
+                'billingUrl' => $request->user() && (bool) config('academy_billing.enabled', false)
+                    ? route('academy.billing.account')
+                    : route('academy.pricing'),
+            ]),
+            'featuredPrompts' => $this->featuredPromptPayloads($request->user()),
+            'popularPrompts' => $this->popularPromptPayloads($request->user()),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::PROMPT_LIBRARY,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_prompts_index',
+                'search' => filled($filters['q'] ?? null) ? [
+                    'query' => (string) $filters['q'],
+                    'resultsCount' => (int) $prompts->total(),
+                ] : null,
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
+    }
+
+    public function popular(Request $request): Response
+    {
+        abort_unless((bool) config('academy.enabled', true), 404);
+
+        $validated = $request->validate([
+            'period' => ['nullable', 'string', 'in:7d,30d,90d'],
+        ]);
+
+        $selectedPeriod = $this->selectedPopularPromptPeriod($validated['period'] ?? null);
+        $from = now()->subDays($selectedPeriod['days'] - 1)->startOfDay();
+        $to = now()->endOfDay();
+
+        $rows = DB::query()
+            ->fromSub(
+                $this->popularity->queryBetween($from, $to)
+                    ->where('content_type', AcademyAnalyticsContentType::PROMPT)
+                    ->whereNotNull('content_id')
+                    ->selectRaw('content_id, sum(views) as views, sum(prompt_copies) as prompt_copies, sum(popularity_score) as popularity_score')
+                    ->groupBy('content_id'),
+                'prompt_rankings'
+            )
+            ->orderByDesc('popularity_score')
+            ->orderByDesc('prompt_copies')
+            ->orderByDesc('views')
+            ->paginate(12)
+            ->withQueryString();
+
+        $prompts = AcademyPromptTemplate::query()
+            ->with('category')
+            ->active()
+            ->published()
+            ->whereIn('id', $rows->pluck('content_id')->map(static fn ($value): int => (int) $value)->all())
+            ->get()
+            ->keyBy('id');
+
+        $baseRank = (($rows->currentPage() - 1) * $rows->perPage());
+
+        $rows->setCollection(
+            $rows->getCollection()
+                ->values()
+                ->map(function (object $row, int $index) use ($prompts, $request, $baseRank, $selectedPeriod): ?array {
+                    $prompt = $prompts->get((int) $row->content_id);
+
+                    if (! $prompt instanceof AcademyPromptTemplate) {
+                        return null;
+                    }
+
+                    $payload = $this->access->promptPayload($prompt, $request->user());
+                    $payload['ranking'] = [
+                        'rank' => $baseRank + $index + 1,
+                        'views' => max(0, (int) ($row->views ?? 0)),
+                        'prompt_copies' => max(0, (int) ($row->prompt_copies ?? 0)),
+                        'popularity_score' => round((float) ($row->popularity_score ?? 0), 2),
+                    ];
+                    $payload['spotlight'] = [
+                        'eyebrow' => max(0, (int) ($row->prompt_copies ?? 0)) > 0
+                            ? sprintf('%d copies %s', (int) $row->prompt_copies, $selectedPeriod['eyebrow_suffix'])
+                            : sprintf('%d views %s', (int) $row->views, $selectedPeriod['eyebrow_suffix']),
+                    ];
+
+                    return $payload;
+                })
+                ->filter()
+                ->values()
+        );
+
+        $seo = app(SeoFactory::class)
+            ->collectionListing(
+                sprintf('%s Prompts — Skinbase Academy', $selectedPeriod['title_prefix']),
+                sprintf('See which Skinbase Academy prompt templates are driving the most views and copies %s.', $selectedPeriod['description_suffix']),
+                route('academy.prompts.popular', $request->query()),
+            )
+            ->toArray();
+
+        if ($selectedPeriod['value'] !== '30d') {
+            $seo = SeoDataBuilder::fromArray($seo)
+                ->indexable(false)
+                ->build()
+                ->toArray();
+        }
+
+        return Inertia::render('Academy/List', [
+            'pageType' => 'prompts',
+            'promptView' => 'popular',
+            'title' => sprintf('%s prompts', $selectedPeriod['title_prefix']),
+            'description' => sprintf('The prompt templates getting the most momentum from views and copies across the Academy %s.', $selectedPeriod['description_suffix']),
+            'seo' => $seo,
+            'breadcrumbs' => [
+                ['label' => 'Academy', 'href' => route('academy.index')],
+                ['label' => 'Prompt Library', 'href' => route('academy.prompts.index')],
+                ['label' => 'Popular Prompts', 'href' => route('academy.prompts.popular')],
+            ],
+            'items' => $rows,
+            'filters' => [],
+            'categories' => [],
+            'pricingUrl' => route('academy.pricing'),
+            'coursesUrl' => route('academy.courses.index'),
+            'packsUrl' => route('academy.packs.index'),
+            'promptPopularUrl' => route('academy.prompts.popular'),
+            'promptLibraryUrl' => route('academy.prompts.index'),
+            'academyAccess' => array_merge($this->access->accessSummary($request->user()), [
+                'billingUrl' => $request->user() && (bool) config('academy_billing.enabled', false)
+                    ? route('academy.billing.account')
+                    : route('academy.pricing'),
+            ]),
+            'popularPeriod' => [
+                'value' => $selectedPeriod['value'],
+                'label' => $selectedPeriod['label'],
+                'description' => $selectedPeriod['description'],
+            ],
+            'popularPeriods' => collect($this->popularPromptPeriods())
+                ->map(fn (array $period): array => [
+                    'value' => $period['value'],
+                    'label' => $period['label'],
+                    'description' => $period['description'],
+                    'href' => route('academy.prompts.popular', ['period' => $period['value']]),
+                    'active' => $period['value'] === $selectedPeriod['value'],
+                ])
+                ->values()
+                ->all(),
+            'featuredPrompts' => $this->featuredPromptPayloads($request->user()),
+            'popularPrompts' => [],
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::PROMPT_POPULAR,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_prompts_popular',
+                'trackingKey' => sprintf('period:%s', $selectedPeriod['value']),
+                'metadata' => [
+                    'period' => $selectedPeriod['value'],
+                    'period_days' => $selectedPeriod['days'],
+                ],
+                'search' => null,
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function popularPromptPeriods(): array
+    {
+        return [
+            [
+                'value' => '7d',
+                'days' => 7,
+                'label' => '7 days',
+                'description' => 'Fresh momentum from the last 7 days.',
+                'title_prefix' => 'Top 7-day',
+                'description_suffix' => 'in the last 7 days',
+                'eyebrow_suffix' => 'in the last 7 days',
+            ],
+            [
+                'value' => '30d',
+                'days' => 30,
+                'label' => '30 days',
+                'description' => 'The default monthly view of prompt momentum.',
+                'title_prefix' => 'Popular',
+                'description_suffix' => 'this month',
+                'eyebrow_suffix' => 'this month',
+            ],
+            [
+                'value' => '90d',
+                'days' => 90,
+                'label' => '90 days',
+                'description' => 'Longer-running prompt momentum across the quarter.',
+                'title_prefix' => 'Top 90-day',
+                'description_suffix' => 'in the last 90 days',
+                'eyebrow_suffix' => 'in the last 90 days',
+            ],
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function selectedPopularPromptPeriod(?string $value): array
+    {
+        return collect($this->popularPromptPeriods())
+            ->first(fn (array $period): bool => $period['value'] === $value)
+            ?? $this->popularPromptPeriods()[1];
     }
 
     public function show(Request $request, string $slug): Response
@@ -102,15 +348,141 @@ final class AcademyPromptController extends Controller
             $canonical,
             $payload['preview_image'] ?? null,
         )->toArray();
+        $existingSchemas = $seo['json_ld'] ?? [];
+        if (! is_array($existingSchemas) || ! array_is_list($existingSchemas)) {
+            $existingSchemas = [$existingSchemas];
+        }
+        $seo['json_ld'] = [
+            ...$existingSchemas,
+            $this->promptStructuredData($payload, $canonical, $description),
+        ];
+
+        $canSavePrompt = $request->user() !== null && $this->access->canAccessPrompt($request->user(), $prompt);
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::PROMPT, (int) $prompt->id);
 
         return Inertia::render('Academy/Show', [
             'pageType' => 'prompt',
             'item' => $payload,
             'seo' => $seo,
             'pricingUrl' => route('academy.pricing'),
-            'saveUrl' => $request->user() ? route('academy.prompts.save', ['prompt' => $prompt->id]) : null,
+            'saveUrl' => $canSavePrompt ? route('academy.prompts.save', ['prompt' => $prompt->id]) : null,
-            'unsaveUrl' => $request->user() ? route('academy.prompts.unsave', ['prompt' => $prompt->id]) : null,
+            'unsaveUrl' => $canSavePrompt ? route('academy.prompts.unsave', ['prompt' => $prompt->id]) : null,
-            'saved' => $request->user()?->academySavedPrompts()->where('prompt_template_id', $prompt->id)->exists() ?? false,
+            'saved' => $canSavePrompt ? ($request->user()?->academySavedPrompts()->where('prompt_template_id', $prompt->id)->exists() ?? false) : false,
-        ])->rootView('collections');
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::PROMPT,
+                'contentId' => (int) $prompt->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_prompt_show',
+                'isPremium' => (string) ($prompt->access_level ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => (bool) ($payload['locked'] ?? false),
+            ],
+        ])->rootView('academy');
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function promptStructuredData(array $payload, string $canonical, string $description): array
+    {
+        $imageUrls = array_values(array_unique(array_filter([
+            $payload['preview_image'] ?? null,
+            ...collect((array) ($payload['public_examples'] ?? []))
+                ->map(fn (array $example): ?string => $example['image_url'] ?? $example['thumb_url'] ?? null)
+                ->filter()
+                ->values()
+                ->all(),
+        ], fn (mixed $value): bool => is_string($value) && $value !== '')));
+        $isFree = (string) ($payload['access_level'] ?? 'free') === 'free';
+
+        return array_filter([
+            '@context' => 'https://schema.org',
+            '@type' => ['CreativeWork', 'LearningResource'],
+            'name' => (string) ($payload['title'] ?? 'Skinbase Academy prompt'),
+            'description' => $description,
+            'url' => $canonical,
+            'image' => $imageUrls !== [] ? $imageUrls : null,
+            'isAccessibleForFree' => $isFree,
+            'hasPart' => $isFree ? null : [
+                '@type' => 'WebPageElement',
+                'isAccessibleForFree' => false,
+                'cssSelector' => '.academy-paywalled-content',
+            ],
+        ], fn (mixed $value): bool => $value !== null && $value !== '' && $value !== []);
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function featuredPromptPayloads(mixed $viewer, int $limit = 4): array
+    {
+        return collect($this->cache->featuredPrompts())
+            ->take($limit)
+            ->map(function (AcademyPromptTemplate $prompt) use ($viewer): array {
+                $payload = $this->access->promptPayload($prompt, $viewer);
+                $payload['spotlight'] = [
+                    'eyebrow' => $prompt->prompt_of_week ? 'Prompt of the week' : 'Featured pick',
+                ];
+
+                return $payload;
+            })
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function popularPromptPayloads(mixed $viewer, int $limit = 4): array
+    {
+        $rows = $this->popularity->queryBetween(now()->subDays(29)->startOfDay(), now()->endOfDay())
+            ->where('content_type', AcademyAnalyticsContentType::PROMPT)
+            ->whereNotNull('content_id')
+            ->selectRaw('content_id, sum(views) as views, sum(prompt_copies) as prompt_copies, sum(popularity_score) as popularity_score')
+            ->groupBy('content_id')
+            ->orderByDesc('popularity_score')
+            ->limit($limit)
+            ->get();
+
+        if ($rows->isEmpty()) {
+            return [];
+        }
+
+        $prompts = AcademyPromptTemplate::query()
+            ->with('category')
+            ->active()
+            ->published()
+            ->whereIn('id', $rows->pluck('content_id')->all())
+            ->get()
+            ->keyBy('id');
+
+        return $rows->map(function ($row) use ($prompts, $viewer): ?array {
+            $prompt = $prompts->get((int) $row->content_id);
+
+            if (! $prompt instanceof AcademyPromptTemplate) {
+                return null;
+            }
+
+            $payload = $this->access->promptPayload($prompt, $viewer);
+            $copies = max(0, (int) ($row->prompt_copies ?? 0));
+            $views = max(0, (int) ($row->views ?? 0));
+            $payload['spotlight'] = [
+                'eyebrow' => $copies > 0 ? sprintf('%d copies this month', $copies) : sprintf('%d views this month', $views),
+            ];
+
+            return $payload;
+        })
+            ->filter()
+            ->values()
+            ->all();
     }
 }

app/Http/Controllers/Academy/AcademyPromptPackController.php

@@ -7,7 +7,10 @@ namespace App\Http\Controllers\Academy;
 use App\Http\Controllers\Controller;
 use App\Models\AcademyPromptPack;
 use App\Services\Academy\AcademyAccessService;
+use App\Services\Academy\AcademyInteractionService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
 use App\Support\Seo\SeoFactory;
+use App\Support\Seo\SeoDataBuilder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 use Inertia\Inertia;
@@ -15,7 +18,10 @@ use Inertia\Response;
 
 final class AcademyPromptPackController extends Controller
 {
-    public function __construct(private readonly AcademyAccessService $access)
+    public function __construct(
+        private readonly AcademyAccessService $access,
+        private readonly AcademyInteractionService $interactions,
+    )
     {
     }
 
@@ -24,7 +30,6 @@ final class AcademyPromptPackController extends Controller
         abort_unless((bool) config('academy.enabled', true), 404);
 
         $packs = AcademyPromptPack::query()
-            ->with('prompts')
             ->active()
             ->published()
             ->latest('published_at')
@@ -40,6 +45,13 @@ final class AcademyPromptPackController extends Controller
                 route('academy.packs.index'),
             )
             ->toArray();
+        $seo = SeoDataBuilder::fromArray($seo)
+            ->breadcrumbs([
+                ['name' => 'Academy', 'url' => route('academy.index')],
+                ['name' => 'Prompt Packs', 'url' => route('academy.packs.index')],
+            ])
+            ->build()
+            ->toArray();
 
         return Inertia::render('Academy/List', [
             'pageType' => 'packs',
@@ -50,7 +62,17 @@ final class AcademyPromptPackController extends Controller
             'filters' => [],
             'categories' => [],
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::PROMPT_PACK_LIBRARY,
+                'contentId' => null,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_packs_index',
+                'isPremium' => false,
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+            ],
+        ])->rootView('academy');
     }
 
     public function show(Request $request, string $slug): Response
@@ -65,18 +87,103 @@ final class AcademyPromptPackController extends Controller
             ->firstOrFail();
 
         $payload = $this->access->packPayload($pack, $request->user(), true);
-        $seo = app(SeoFactory::class)->collectionPage(
+        $canonical = route('academy.packs.show', ['slug' => $pack->slug]);
+        $description = Str::limit((string) ($pack->excerpt ?? $pack->description ?? ''), 160, '...');
+        $seo = SeoDataBuilder::fromArray(
+            app(SeoFactory::class)->collectionPage(
                 $pack->title . ' — Skinbase Academy',
-            Str::limit((string) ($pack->excerpt ?? $pack->description ?? ''), 160, '...'),
+                $description,
-            route('academy.packs.show', ['slug' => $pack->slug]),
+                $canonical,
                 $pack->cover_image,
-        )->toArray();
+            )->toArray()
+        )
+            ->breadcrumbs([
+                ['name' => 'Academy', 'url' => route('academy.index')],
+                ['name' => 'Prompt Packs', 'url' => route('academy.packs.index')],
+                ['name' => (string) $pack->title, 'url' => $canonical],
+            ])
+            ->addJsonLd($this->packStructuredData($payload, $canonical, $description))
+            ->build()
+            ->toArray();
+
+        $interaction = $this->interactions->getInteractionState($request->user(), AcademyAnalyticsContentType::PROMPT_PACK, (int) $pack->id);
 
         return Inertia::render('Academy/Show', [
             'pageType' => 'pack',
             'item' => $payload,
             'seo' => $seo,
             'pricingUrl' => route('academy.pricing'),
-        ])->rootView('collections');
+            'interaction' => $interaction,
+            'interactionRoutes' => [
+                'like' => route('academy.interactions.like'),
+                'save' => route('academy.interactions.save'),
+            ],
+            'loginUrl' => route('login'),
+            'analytics' => [
+                'enabled' => true,
+                'contentType' => AcademyAnalyticsContentType::PROMPT_PACK,
+                'contentId' => (int) $pack->id,
+                'eventUrl' => route('academy.analytics.events.store'),
+                'pageName' => 'academy_pack_show',
+                'isPremium' => (string) ($pack->access_level ?? 'free') !== 'free',
+                'isGuest' => $request->user() === null,
+                'isSubscriber' => $request->user()?->hasAcademyCreatorAccess() || $request->user()?->hasAcademyProAccess(),
+                'isLocked' => (bool) ($payload['locked'] ?? false),
+            ],
+        ])->rootView('academy');
+    }
+
+    /**
+     * @param  array<string, mixed>  $payload
+     * @return array<string, mixed>
+     */
+    private function packStructuredData(array $payload, string $canonical, string $description): array
+    {
+        $image = trim((string) ($payload['cover_image'] ?? ''));
+        $imageUrl = $image !== '' && preg_match('/^https?:\/\//i', $image) === 1 ? $image : ($image !== '' ? url($image) : null);
+        $keywords = array_values((array) ($payload['tags'] ?? []));
+        $isFree = (string) ($payload['access_level'] ?? 'free') === 'free';
+        $promptEntries = collect((array) ($payload['prompts'] ?? []))
+            ->map(function (array $prompt): ?array {
+                $title = trim((string) ($prompt['title'] ?? ''));
+                $slug = trim((string) ($prompt['slug'] ?? ''));
+
+                if ($title === '' || $slug === '') {
+                    return null;
+                }
+
+                return [
+                    '@type' => 'ListItem',
+                    'position' => null,
+                    'item' => [
+                        '@type' => 'CreativeWork',
+                        'name' => $title,
+                        'url' => route('academy.prompts.show', ['slug' => $slug]),
+                    ],
+                ];
+            })
+            ->filter()
+            ->values()
+            ->map(function (array $item, int $index): array {
+                $item['position'] = $index + 1;
+
+                return $item;
+            })
+            ->all();
+
+        return array_filter([
+            '@context' => 'https://schema.org',
+            '@type' => ['CreativeWork', 'LearningResource'],
+            'name' => (string) ($payload['title'] ?? 'Skinbase Academy prompt pack'),
+            'description' => $description,
+            'url' => $canonical,
+            'image' => $imageUrl,
+            'keywords' => $keywords !== [] ? $keywords : null,
+            'isAccessibleForFree' => $isFree,
+            'hasPart' => $promptEntries !== [] ? [
+                '@type' => 'ItemList',
+                'itemListElement' => $promptEntries,
+            ] : null,
+        ], fn (mixed $value): bool => $value !== null && $value !== '' && $value !== []);
     }
 }

app/Http/Controllers/Admin/AdsenseAnalyticsController.php

@@ -0,0 +1,266 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Jobs\SyncAdsenseJob;
+use App\Models\AdsenseConnection;
+use App\Services\Adsense\AdsenseAnalyticsQueryService;
+use App\Services\Adsense\AdsenseApiClient;
+use App\Services\Adsense\AdsenseLogSanitizer;
+use App\Services\Adsense\AdsenseOAuthService;
+use App\Services\Adsense\Exceptions\AdsenseApiException;
+use App\Services\Adsense\Exceptions\AdsenseAuthorizationException;
+use App\Services\Adsense\Exceptions\AdsenseOAuthException;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class AdsenseAnalyticsController extends Controller
+{
+    public function __construct(
+        private readonly AdsenseOAuthService $oauth,
+        private readonly AdsenseApiClient $api,
+        private readonly AdsenseAnalyticsQueryService $query,
+    ) {}
+
+    public function index(Request $request): Response
+    {
+        $connection = AdsenseConnection::current();
+        $range = $this->query->resolveRange(
+            $request->query('period'),
+            $request->string('from')->toString() ?: null,
+            $request->string('to')->toString() ?: null,
+        );
+
+        $dashboard = null;
+        if ($connection !== null && $connection->isConnected() && filled($connection->account_resource_name)) {
+            $dashboard = $this->query->dashboard(
+                $connection,
+                $range['from'],
+                $range['to'],
+                $range['previous_from'],
+                $range['previous_to'],
+            );
+        }
+
+        return Inertia::render('Admin/Adsense/Index', [
+            'connection' => $this->connectionPayload($connection),
+            'configured' => $this->oauth->isConfigured(),
+            'pendingAccounts' => $request->session()->get(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, []),
+            'recommendedPlacements' => array_values((array) config('adsense.recommended_placement_names', [])),
+            'range' => [
+                'period' => $range['period'],
+                'from' => $range['from']->toDateString(),
+                'to' => $range['to']->toDateString(),
+                'previous_from' => $range['previous_from']->toDateString(),
+                'previous_to' => $range['previous_to']->toDateString(),
+            ],
+            'dashboard' => $dashboard,
+            'routes' => [
+                'index' => route('admin.adsense.index'),
+                'connect' => route('admin.adsense.connect'),
+                'account' => route('admin.adsense.account'),
+                'sync' => route('admin.adsense.sync'),
+                'disconnect' => route('admin.adsense.disconnect'),
+            ],
+        ]);
+    }
+
+    public function connect(Request $request): RedirectResponse
+    {
+        if (! $this->oauth->isConfigured()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'Google AdSense OAuth is not configured.');
+        }
+
+        try {
+            return redirect()->away($this->oauth->authorizationUrl($request, true));
+        } catch (AdsenseOAuthException $exception) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $exception->getMessage());
+        }
+    }
+
+    public function callback(Request $request): RedirectResponse
+    {
+        try {
+            $code = $this->oauth->assertValidCallback($request);
+            $tokens = $this->oauth->exchangeAuthorizationCode($code);
+            $connection = AdsenseConnection::current() ?? new AdsenseConnection;
+            $connection->status = AdsenseConnection::STATUS_PENDING;
+            $this->oauth->persistTokens($connection, $tokens, $request->user()?->id);
+
+            $accounts = $this->api->listAccounts($connection);
+        } catch (AdsenseOAuthException|AdsenseAuthorizationException|AdsenseApiException $exception) {
+            Log::warning('AdSense OAuth callback failed.', AdsenseLogSanitizer::context([
+                'message' => $exception->getMessage(),
+            ]));
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $exception->getMessage());
+        }
+
+        $normalized = collect($accounts)
+            ->map(function (array $account): ?array {
+                $name = (string) ($account['name'] ?? '');
+                if ($name === '') {
+                    return null;
+                }
+
+                return [
+                    'resource_name' => $name,
+                    'display_name' => (string) ($account['displayName'] ?? $name),
+                ];
+            })
+            ->filter()
+            ->values()
+            ->all();
+
+        if ($normalized === []) {
+            $connection->status = AdsenseConnection::STATUS_ERROR;
+            $connection->last_error = 'No Google AdSense accounts were available for this Google account.';
+            $connection->save();
+            $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $connection->last_error);
+        }
+
+        if (count($normalized) === 1) {
+            $this->assignAccount($connection, $normalized[0]['resource_name'], $normalized[0]['display_name']);
+            $this->queueAdsenseSync($connection, 30);
+            $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('success', 'Google AdSense connected. Initial synchronization has started.');
+        }
+
+        $request->session()->put(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, $normalized);
+        $connection->status = AdsenseConnection::STATUS_PENDING;
+        $connection->save();
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('warning', 'Select the Google AdSense account to use for Skinbase analytics.');
+    }
+
+    public function selectAccount(Request $request): RedirectResponse
+    {
+        $validated = $request->validate([
+            'account_resource_name' => ['required', 'string', 'max:128'],
+        ]);
+
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->hasRefreshToken()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'Connect Google AdSense before selecting an account.');
+        }
+
+        $pending = collect($request->session()->get(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY, []));
+        $selected = $pending->firstWhere('resource_name', $validated['account_resource_name']);
+
+        if (! is_array($selected)) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', 'The selected AdSense account is not available.');
+        }
+
+        $this->assignAccount(
+            $connection,
+            (string) $selected['resource_name'],
+            (string) ($selected['display_name'] ?? $selected['resource_name']),
+        );
+        $this->queueAdsenseSync($connection, 30);
+        $request->session()->forget(AdsenseOAuthService::SESSION_PENDING_ACCOUNTS_KEY);
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'AdSense account selected. Initial synchronization has started.');
+    }
+
+    public function sync(Request $request): RedirectResponse
+    {
+        $connection = AdsenseConnection::current();
+        if ($connection === null || ! $connection->isConnected()) {
+            return redirect()
+                ->route('admin.adsense.index')
+                ->with('error', $connection?->needsReconnect()
+                    ? 'AdSense authorization expired or was revoked. Reconnect Google AdSense.'
+                    : 'Google AdSense is not connected.');
+        }
+
+        $this->queueAdsenseSync($connection, 3);
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'AdSense synchronization has been queued.');
+    }
+
+    public function disconnect(): RedirectResponse
+    {
+        $connection = AdsenseConnection::current();
+        if ($connection !== null) {
+            $this->oauth->disconnect($connection);
+        }
+
+        return redirect()
+            ->route('admin.adsense.index')
+            ->with('success', 'Google AdSense has been disconnected. Historical statistics were kept.');
+    }
+
+    /**
+     * @return array<string, mixed>|null
+     */
+    private function connectionPayload(?AdsenseConnection $connection): ?array
+    {
+        if ($connection === null) {
+            return null;
+        }
+
+        return [
+            'status' => $connection->status,
+            'account_resource_name' => $connection->account_resource_name,
+            'account_display_name' => $connection->account_display_name,
+            'connected_at' => optional($connection->connected_at)?->toIso8601String(),
+            'last_sync_attempt_at' => optional($connection->last_sync_attempt_at)?->toIso8601String(),
+            'last_successful_sync_at' => optional($connection->last_successful_sync_at)?->toIso8601String(),
+            'last_error' => $connection->last_error,
+            'needs_reconnect' => $connection->needsReconnect(),
+        ];
+    }
+
+    private function assignAccount(AdsenseConnection $connection, string $resourceName, string $displayName): void
+    {
+        $connection->account_resource_name = $resourceName;
+        $connection->account_display_name = $displayName;
+        $connection->status = AdsenseConnection::STATUS_CONNECTED;
+        $connection->last_error = null;
+        if ($connection->connected_at === null) {
+            $connection->connected_at = now();
+        }
+        $connection->save();
+    }
+
+    private function queueAdsenseSync(AdsenseConnection $connection, int $days): void
+    {
+        $to = now()->startOfDay();
+        $from = $to->copy()->subDays(max(1, $days) - 1);
+
+        SyncAdsenseJob::dispatch(
+            (int) $connection->id,
+            $from->toDateString(),
+            $to->toDateString(),
+        );
+    }
+}

app/Http/Controllers/Admin/SecurityReportController.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Jobs\RunSecurityReportScanJob;
+use App\Models\SecurityReport;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class SecurityReportController extends Controller
+{
+    public function index(): Response
+    {
+        abort_unless((bool) config('security-report.enabled', true), 404);
+
+        $latest = SecurityReport::query()->latest('id')->with('user:id,name,username')->first();
+        $reports = SecurityReport::query()
+            ->with('user:id,name,username')
+            ->latest('id')
+            ->paginate(20)
+            ->through(fn (SecurityReport $report): array => $this->mapListItem($report));
+
+        return Inertia::render('Admin/System/SecurityReportIndex', [
+            'latest' => $latest ? $this->mapDetail($latest) : null,
+            'reports' => $reports,
+            'canRunScan' => true,
+        ])->rootView('moderation');
+    }
+
+    public function show(SecurityReport $securityReport): Response
+    {
+        abort_unless((bool) config('security-report.enabled', true), 404);
+
+        $securityReport->load('user:id,name,username');
+
+        return Inertia::render('Admin/System/SecurityReportShow', [
+            'report' => $this->mapDetail($securityReport),
+        ])->rootView('moderation');
+    }
+
+    public function run(Request $request): RedirectResponse
+    {
+        abort_unless((bool) config('security-report.enabled', true), 404);
+
+        RunSecurityReportScanJob::dispatch($request->user()?->id);
+
+        return redirect()
+            ->route('admin.system.security-report.index')
+            ->with('success', 'Security scan has been queued.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapListItem(SecurityReport $report): array
+    {
+        return [
+            'id' => (int) $report->id,
+            'status' => (string) $report->status,
+            'risk_label' => (string) $report->risk_label,
+            'finished_at' => optional($report->finished_at)?->toIso8601String(),
+            'total_critical' => (int) $report->total_critical,
+            'total_high' => (int) $report->total_high,
+            'total_medium' => (int) $report->total_medium,
+            'total_low' => (int) $report->total_low,
+            'composer_outdated_count' => (int) $report->composer_outdated_count,
+            'npm_outdated_count' => (int) $report->npm_outdated_count,
+            'show_url' => route('admin.system.security-report.show', ['securityReport' => $report]),
+            'triggered_by' => (string) ($report->triggered_by ?? ''),
+            'user' => $report->user ? [
+                'id' => (int) $report->user->id,
+                'name' => (string) $report->user->name,
+                'username' => (string) ($report->user->username ?? ''),
+            ] : null,
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapDetail(SecurityReport $report): array
+    {
+        return [
+            'id' => (int) $report->id,
+            'status' => (string) $report->status,
+            'risk_label' => (string) $report->risk_label,
+            'started_at' => optional($report->started_at)?->toIso8601String(),
+            'finished_at' => optional($report->finished_at)?->toIso8601String(),
+            'composer_critical' => (int) $report->composer_critical,
+            'composer_high' => (int) $report->composer_high,
+            'composer_medium' => (int) $report->composer_medium,
+            'composer_low' => (int) $report->composer_low,
+            'composer_unknown' => (int) $report->composer_unknown,
+            'npm_critical' => (int) $report->npm_critical,
+            'npm_high' => (int) $report->npm_high,
+            'npm_moderate' => (int) $report->npm_moderate,
+            'npm_low' => (int) $report->npm_low,
+            'npm_info' => (int) $report->npm_info,
+            'npm_unknown' => (int) $report->npm_unknown,
+            'total_critical' => (int) $report->total_critical,
+            'total_high' => (int) $report->total_high,
+            'total_medium' => (int) $report->total_medium,
+            'total_low' => (int) $report->total_low,
+            'total_unknown' => (int) $report->total_unknown,
+            'composer_outdated_count' => (int) $report->composer_outdated_count,
+            'npm_outdated_count' => (int) $report->npm_outdated_count,
+            'summary' => $report->summary ?? [],
+            'triggered_by' => (string) ($report->triggered_by ?? ''),
+            'error_message' => (string) ($report->error_message ?? ''),
+            'show_url' => route('admin.system.security-report.show', ['securityReport' => $report]),
+            'index_url' => route('admin.system.security-report.index'),
+            'composer_audit' => $report->composer_audit,
+            'composer_outdated' => $report->composer_outdated,
+            'npm_audit' => $report->npm_audit,
+            'npm_outdated' => $report->npm_outdated,
+            'composer_advisories' => $report->composerAdvisories(),
+            'npm_vulnerabilities' => $report->npmVulnerabilities(),
+            'user' => $report->user ? [
+                'id' => (int) $report->user->id,
+                'name' => (string) $report->user->name,
+                'username' => (string) ($report->user->username ?? ''),
+            ] : null,
+        ];
+    }
+}

app/Http/Controllers/Api/Admin/ArtworkModerationController.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Jobs\IndexArtworkJob;
+use App\Models\Artwork;
+use App\Services\NotificationService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+final class ArtworkModerationController extends Controller
+{
+    public function pending(): JsonResponse
+    {
+        $artworks = Artwork::query()
+            ->with([
+                'user:id,name,username,level,email',
+                'tags:id,name,slug',
+                'categories:id,name,slug',
+            ])
+            ->where('artwork_status', 'review')
+            ->where('is_approved', false)
+            ->latest('created_at')
+            ->limit(100)
+            ->get([
+                'id', 'user_id', 'title', 'description', 'hash', 'thumb_ext',
+                'artwork_status', 'moderation_note', 'created_at', 'slug',
+                'is_mature', 'maturity_status', 'visibility',
+            ])
+            ->map(fn (Artwork $artwork): array => $this->present($artwork))
+            ->values();
+
+        return response()->json(['data' => $artworks], Response::HTTP_OK);
+    }
+
+    public function approve(int $id, Request $request, NotificationService $notifications): JsonResponse
+    {
+        $artwork = Artwork::query()->with('user')->where('artwork_status', 'review')->find($id);
+        if (! $artwork) {
+            return response()->json(['message' => 'Artwork not found in review queue.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $artwork->forceFill([
+            'is_approved' => true,
+            'is_public' => $artwork->visibility !== Artwork::VISIBILITY_PRIVATE,
+            'artwork_status' => 'published',
+            'published_at' => now(),
+            'approval_source' => 'moderator',
+            'moderated_at' => now(),
+            'moderated_by' => $request->user()->id,
+            'moderation_note' => $request->input('note'),
+        ])->save();
+
+        IndexArtworkJob::dispatch((int) $artwork->id);
+
+        if ($artwork->user) {
+            $notifications->notifyArtworkApproved($artwork->user, $request->user(), $artwork);
+        }
+
+        return response()->json(['success' => true, 'id' => $artwork->id, 'status' => 'published']);
+    }
+
+    public function reject(int $id, Request $request, NotificationService $notifications): JsonResponse
+    {
+        $artwork = Artwork::query()->with('user')->where('artwork_status', 'review')->find($id);
+        if (! $artwork) {
+            return response()->json(['message' => 'Artwork not found in review queue.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $note = (string) $request->input('note', 'Rejected during upload moderation.');
+
+        $artwork->forceFill([
+            'is_approved' => false,
+            'is_public' => false,
+            'artwork_status' => 'rejected',
+            'published_at' => null,
+            'moderated_at' => now(),
+            'moderated_by' => $request->user()->id,
+            'moderation_note' => $note,
+        ])->save();
+
+        IndexArtworkJob::dispatch((int) $artwork->id);
+
+        if ($artwork->user) {
+            $notifications->notifyArtworkRejected($artwork->user, $request->user(), $artwork, $note);
+        }
+
+        return response()->json(['success' => true, 'id' => $artwork->id, 'status' => 'rejected']);
+    }
+
+    private function present(Artwork $artwork): array
+    {
+        $previewUrl = $artwork->thumbUrl('md') ?: $artwork->thumbUrl('sm');
+        $previewLgUrl = $artwork->thumbUrl('lg') ?: $previewUrl;
+
+        return [
+            'id' => (int) $artwork->id,
+            'title' => (string) ($artwork->title ?: '(untitled artwork)'),
+            'description' => (string) ($artwork->description ?? ''),
+            'type' => 'artwork',
+            'preview_url' => $previewUrl,
+            'preview_lg_url' => $previewLgUrl,
+            'tags' => $artwork->tags
+                ->map(fn ($tag): string => trim((string) ($tag->name ?: $tag->slug)))
+                ->filter()
+                ->values()
+                ->all(),
+            'categories' => $artwork->categories
+                ->map(fn ($category): string => trim((string) ($category->name ?: $category->slug)))
+                ->filter()
+                ->values()
+                ->all(),
+            'user' => $artwork->user ? [
+                'id' => (int) $artwork->user->id,
+                'name' => (string) $artwork->user->name,
+                'username' => $artwork->user->username,
+            ] : null,
+            'slug' => $artwork->slug,
+            'is_mature' => (bool) $artwork->is_mature,
+            'maturity_status' => $artwork->maturity_status,
+            'visibility' => $artwork->visibility,
+            'moderation_note' => $artwork->moderation_note,
+            'created_at' => optional($artwork->created_at)?->toISOString(),
+        ];
+    }
+}

app/Http/Controllers/Api/Admin/UploadModerationController.php

@@ -8,33 +8,51 @@ use App\Http\Controllers\Controller;
 use App\Models\Upload;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\URL;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
 
 final class UploadModerationController extends Controller
 {
     public function pending(): JsonResponse
     {
         $uploads = Upload::query()
+            ->with(['user:id,name,username', 'category:id,name,slug'])
             ->where('status', 'draft')
             ->where('moderation_status', 'pending')
             ->orderBy('created_at')
-            ->get([
+            ->get()
-                'id',
+            ->map(fn (Upload $upload): array => $this->present($upload))
-                'user_id',
+            ->values();
-                'type',
-                'status',
-                'processing_state',
-                'title',
-                'preview_path',
-                'created_at',
-                'moderation_status',
-            ]);
 
         return response()->json([
             'data' => $uploads,
         ], Response::HTTP_OK);
     }
 
+    public function preview(string $id): StreamedResponse|JsonResponse
+    {
+        $upload = Upload::query()
+            ->where('status', 'draft')
+            ->where('moderation_status', 'pending')
+            ->find($id);
+
+        if (! $upload) {
+            return response()->json(['message' => 'Upload not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        $path = $this->safePreviewPath($upload);
+        if ($path === null || ! Storage::disk('local')->exists($path)) {
+            return response()->json(['message' => 'Preview not found.'], Response::HTTP_NOT_FOUND);
+        }
+
+        return Storage::disk('local')->response($path, 'preview.webp', [
+            'Content-Type' => 'image/webp',
+            'Cache-Control' => 'private, max-age=120',
+        ]);
+    }
+
     public function approve(string $id, Request $request): JsonResponse
     {
         $upload = Upload::query()->find($id);
@@ -80,4 +98,56 @@ final class UploadModerationController extends Controller
             'moderation_status' => (string) $upload->moderation_status,
         ], Response::HTTP_OK);
     }
+
+    private function present(Upload $upload): array
+    {
+        $tags = collect($upload->tags ?? [])
+            ->map(function (mixed $tag): string {
+                if (is_array($tag)) {
+                    return trim((string) ($tag['name'] ?? $tag['slug'] ?? ''));
+                }
+
+                return trim((string) $tag);
+            })
+            ->filter()
+            ->values()
+            ->all();
+
+        $hasPreview = $this->safePreviewPath($upload) !== null;
+
+        return [
+            'id' => (string) $upload->id,
+            'title' => (string) ($upload->title ?: '(untitled upload)'),
+            'description' => (string) ($upload->description ?? ''),
+            'type' => (string) ($upload->type ?? 'image'),
+            'preview_url' => $hasPreview
+                ? URL::temporarySignedRoute('api.admin.uploads.preview', now()->addMinutes(30), ['id' => $upload->id])
+                : null,
+            'preview_lg_url' => $hasPreview
+                ? URL::temporarySignedRoute('api.admin.uploads.preview', now()->addMinutes(30), ['id' => $upload->id])
+                : null,
+            'tags' => $tags,
+            'categories' => $upload->category?->name ? [(string) $upload->category->name] : [],
+            'user' => $upload->user ? [
+                'id' => (int) $upload->user->id,
+                'name' => (string) $upload->user->name,
+                'username' => $upload->user->username,
+            ] : null,
+            'nsfw' => (bool) $upload->nsfw,
+            'license' => $upload->license,
+            'created_at' => optional($upload->created_at)?->toISOString(),
+        ];
+    }
+
+    private function safePreviewPath(Upload $upload): ?string
+    {
+        $path = str_replace('\\', '/', ltrim((string) $upload->preview_path, '/'));
+        $expectedPrefix = 'tmp/drafts/'.$upload->id.'/';
+
+        if ($path === '' || str_contains($path, '..') || ! str_starts_with($path, $expectedPrefix)) {
+            return null;
+        }
+
+        return $path;
+    }
 }

app/Http/Controllers/Api/ArtworkCommentController.php

@@ -3,14 +3,17 @@
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
-use App\Services\Activity\UserActivityService;
+use App\Models\ActivityEvent;
 use App\Models\Artwork;
 use App\Models\ArtworkComment;
 use App\Models\User;
 use App\Models\UserMention;
 use App\Notifications\ArtworkCommentedNotification;
 use App\Notifications\ArtworkMentionedNotification;
+use App\Services\Activity\UserActivityService;
+use App\Services\CommentReactionService;
 use App\Services\ContentSanitizer;
+use App\Services\Moderation\CommentSpamService;
 use App\Support\AvatarUrl;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
@@ -30,6 +33,11 @@ class ArtworkCommentController extends Controller
 {
     private const MAX_LENGTH = 10_000;
 
+    public function __construct(
+        private readonly CommentReactionService $commentReactions,
+        private readonly CommentSpamService $commentSpam,
+    ) {}
+
     // ─────────────────────────────────────────────────────────────────────────
     // List
     // ─────────────────────────────────────────────────────────────────────────
@@ -53,7 +61,9 @@ class ArtworkCommentController extends Controller
             ->paginate($perPage, ['*'], 'page', $page);
 
         $userId = $request->user()?->id;
-        $items  = $comments->getCollection()->map(fn ($c) => $this->formatComment($c, $userId, true));
+        $commentIds = $this->commentIds($comments->getCollection());
+        $reactionTotals = $this->commentReactions->forComments($commentIds, $userId);
+        $items = $comments->getCollection()->map(fn ($c) => $this->formatComment($c, $userId, true, $reactionTotals));
 
         return response()->json([
             'data' => $items,
@@ -75,7 +85,7 @@ class ArtworkCommentController extends Controller
         $artwork = Artwork::public()->published()->findOrFail($artworkId);
 
         $request->validate([
-            'content'   => ['required', 'string', 'min:1', 'max:' . self::MAX_LENGTH],
+            'content' => ['required', 'string', 'min:1', 'max:'.self::MAX_LENGTH],
             'parent_id' => ['nullable', 'integer', 'exists:artwork_comments,id'],
         ]);
 
@@ -110,35 +120,48 @@ class ArtworkCommentController extends Controller
             'content' => $raw,      // legacy column (plain text fallback)
             'raw_content' => $raw,
             'rendered_content' => $rendered,
-            'is_approved'      => true,       // auto-approve; extend with moderation as needed
+            'is_approved' => true,
         ]);
 
+        $moderation = $this->commentSpam->moderate($comment, $request->user());
+
         // Bust the comments cache for this user's 'all' feed
         Cache::forget('comments.latest.all.page1');
 
         $comment->load(['user', 'user.profile']);
+        if ($comment->is_approved) {
             $this->notifyRecipients($artwork, $comment, $request->user(), $parentId ? (int) $parentId : null);
+        }
 
         // Record activity event (fire-and-forget; never break the response)
         try {
-            \App\Models\ActivityEvent::record(
+            ActivityEvent::record(
                 actorId: $request->user()->id,
-                type:       \App\Models\ActivityEvent::TYPE_COMMENT,
+                type: ActivityEvent::TYPE_COMMENT,
-                targetType: \App\Models\ActivityEvent::TARGET_ARTWORK,
+                targetType: ActivityEvent::TARGET_ARTWORK,
                 targetId: $artwork->id,
             );
-        } catch (\Throwable) {}
+        } catch (\Throwable) {
+        }
 
         try {
+            if ($comment->is_approved) {
                 app(UserActivityService::class)->logComment(
                     (int) $request->user()->id,
                     (int) $comment->id,
                     $parentId !== null,
                     ['artwork_id' => (int) $artwork->id],
                 );
-        } catch (\Throwable) {}
+            }
+        } catch (\Throwable) {
+        }
 
-        return response()->json(['data' => $this->formatComment($comment, $request->user()->id, false)], 201);
+        $reactionTotals = $this->commentReactions->forComments([$comment->id], $request->user()->id);
+
+        return response()->json([
+            'data' => $this->formatComment($comment, $request->user()->id, false, $reactionTotals),
+            'moderation' => ['status' => $moderation['status']],
+        ], 201);
     }
 
     // ─────────────────────────────────────────────────────────────────────────
@@ -153,7 +176,7 @@ class ArtworkCommentController extends Controller
         Gate::authorize('update', $comment);
 
         $request->validate([
-            'content' => ['required', 'string', 'min:1', 'max:' . self::MAX_LENGTH],
+            'content' => ['required', 'string', 'min:1', 'max:'.self::MAX_LENGTH],
         ]);
 
         $raw = $request->input('content');
@@ -197,7 +220,7 @@ class ArtworkCommentController extends Controller
     // Helpers
     // ─────────────────────────────────────────────────────────────────────────
 
-    private function formatComment(ArtworkComment $c, ?int $currentUserId, bool $includeReplies = false): array
+    private function formatComment(ArtworkComment $c, ?int $currentUserId, bool $includeReplies = false, array $reactionTotals = []): array
     {
         $user = $c->user;
         $userId = (int) ($c->user_id ?? 0);
@@ -216,17 +239,18 @@ class ArtworkCommentController extends Controller
                 'id' => $userId,
                 'username' => $user?->username,
                 'display' => $user?->username ?? $user?->name ?? 'User',
-                'profile_url' => $user?->username ? '/@' . $user->username : '/profile/' . $userId,
+                'profile_url' => $user?->username ? '/@'.$user->username : '/profile/'.$userId,
                 'avatar_url' => AvatarUrl::forUser($userId, $avatarHash, 64),
                 'level' => (int) ($user?->level ?? 1),
                 'rank' => (string) ($user?->rank ?? 'Newbie'),
             ],
+            'reactions' => $reactionTotals[(int) $c->id] ?? [],
         ];
 
         if ($includeReplies && $c->relationLoaded('approvedReplies')) {
-            $data['replies'] = $c->approvedReplies->map(fn ($r) => $this->formatComment($r, $currentUserId, true))->values()->toArray();
+            $data['replies'] = $c->approvedReplies->map(fn ($r) => $this->formatComment($r, $currentUserId, true, $reactionTotals))->values()->toArray();
         } elseif ($includeReplies && $c->relationLoaded('replies')) {
-            $data['replies'] = $c->replies->map(fn ($r) => $this->formatComment($r, $currentUserId, true))->values()->toArray();
+            $data['replies'] = $c->replies->map(fn ($r) => $this->formatComment($r, $currentUserId, true, $reactionTotals))->values()->toArray();
         } else {
             $data['replies'] = [];
         }
@@ -234,6 +258,24 @@ class ArtworkCommentController extends Controller
         return $data;
     }
 
+    /** @param iterable<int, ArtworkComment> $comments */
+    private function commentIds(iterable $comments): array
+    {
+        $ids = [];
+        $walk = function (iterable $items) use (&$walk, &$ids): void {
+            foreach ($items as $comment) {
+                $ids[] = (int) $comment->id;
+                if ($comment->relationLoaded('approvedReplies')) {
+                    $walk($comment->approvedReplies);
+                }
+            }
+        };
+
+        $walk($comments);
+
+        return array_values(array_unique($ids));
+    }
+
     private function renderCommentContent(ArtworkComment $comment): string
     {
         $rawContent = (string) ($comment->raw_content ?? $comment->content ?? '');

app/Http/Controllers/Api/ArtworkController.php

@@ -1,13 +1,14 @@
 <?php
+
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Http\Requests\Artworks\ArtworkCreateRequest;
 use App\Http\Resources\ArtworkListResource;
 use App\Http\Resources\ArtworkResource;
-use App\Services\ArtworkService;
-use App\Services\Artworks\ArtworkDraftService;
 use App\Models\Category;
+use App\Services\Artworks\ArtworkDraftService;
+use App\Services\ArtworkService;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
@@ -29,9 +30,12 @@ class ArtworkController extends Controller
         $user = $request->user();
         $data = $request->validated();
 
-        $categoryId = isset($data['category']) && ctype_digit((string) $data['category'])
+        $categoryId = isset($data['primary_category_id']) && ctype_digit((string) $data['primary_category_id'])
+            ? (int) $data['primary_category_id']
+            : (isset($data['category']) && ctype_digit((string) $data['category'])
                 ? (int) $data['category']
-            : null;
+                : null);
+        $secondaryCategoryIds = array_values(array_map('intval', $data['secondary_category_ids'] ?? []));
 
         $result = $drafts->createDraft(
             $user,
@@ -40,6 +44,7 @@ class ArtworkController extends Controller
             $categoryId,
             (bool) ($data['is_mature'] ?? false),
             $data['group'] ?? null,
+            $secondaryCategoryIds,
         );
 
         return response()->json([

app/Http/Controllers/Api/ArtworkNavigationController.php

@@ -5,11 +5,15 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\ArtworkResource;
 use App\Models\Artwork;
+use App\Services\ArtworkNavigationService;
+use App\Services\ThumbnailPresenter;
 use Illuminate\Http\JsonResponse;
-use Illuminate\Support\Str;
+use Illuminate\Http\Request;
 
 class ArtworkNavigationController extends Controller
 {
+    public function __construct(private readonly ArtworkNavigationService $navigation) {}
+
     /**
      * GET /api/artworks/navigation/{id}
      *
@@ -26,35 +30,11 @@ class ArtworkNavigationController extends Controller
                 'prev_id'   => null, 'next_id'   => null,
                 'prev_url'  => null, 'next_url'  => null,
                 'prev_slug' => null, 'next_slug' => null,
+                'prev_preview' => null, 'next_preview' => null,
             ]);
         }
 
-        $scope = Artwork::published()
+        return response()->json($this->navigation->navigationFor($artwork));
-            ->select(['id', 'title', 'slug'])
-            ->where('user_id', $artwork->user_id);
-
-        $prev = (clone $scope)->where('id', '<', $id)->orderByDesc('id')->first();
-        $next = (clone $scope)->where('id', '>', $id)->orderBy('id')->first();
-
-        // Infinite loop: wrap around when reaching the first or last artwork
-        if (! $prev) {
-            $prev = (clone $scope)->where('id', '!=', $id)->orderByDesc('id')->first();
-        }
-        if (! $next) {
-            $next = (clone $scope)->where('id', '!=', $id)->orderBy('id')->first();
-        }
-
-        $prevSlug = $prev ? (Str::slug($prev->slug ?: $prev->title) ?: (string) $prev->id) : null;
-        $nextSlug = $next ? (Str::slug($next->slug ?: $next->title) ?: (string) $next->id) : null;
-
-        return response()->json([
-            'prev_id'   => $prev?->id,
-            'next_id'   => $next?->id,
-            'prev_url'  => $prev ? url('/art/' . $prev->id . '/' . $prevSlug) : null,
-            'next_url'  => $next ? url('/art/' . $next->id . '/' . $nextSlug) : null,
-            'prev_slug' => $prevSlug,
-            'next_slug' => $nextSlug,
-        ]);
     }
 
     /**
@@ -62,8 +42,12 @@ class ArtworkNavigationController extends Controller
      *
      * Returns full artwork resource by numeric ID for client-side (no-reload) navigation.
      */
-    public function pageData(int $id): JsonResponse
+    public function pageData(Request $request, int $id): JsonResponse
     {
+        if ($request->boolean('prefetch')) {
+            return $this->prefetchData($id);
+        }
+
         $artwork = Artwork::with(['user.profile', 'categories.contentType', 'categories.parent.contentType', 'tags', 'stats'])
             ->published()
             ->find($id);
@@ -73,7 +57,30 @@ class ArtworkNavigationController extends Controller
         }
 
         $resource = (new ArtworkResource($artwork))->toArray(request());
+        $resource['navigation'] = $this->navigation->navigationFor($artwork);
 
         return response()->json($resource);
     }
+
+    private function prefetchData(int $id): JsonResponse
+    {
+        $artwork = Artwork::query()
+            ->published()
+            ->select(['id', 'title', 'slug', 'hash', 'file_path', 'file_name'])
+            ->find($id);
+
+        if (! $artwork) {
+            return response()->json(['error' => 'Not found'], 404);
+        }
+
+        return response()->json([
+            'id' => (int) $artwork->id,
+            'title' => (string) $artwork->title,
+            'slug' => (string) $artwork->slug,
+            'thumbs' => [
+                'md' => ThumbnailPresenter::present($artwork, 'md'),
+                'lg' => ThumbnailPresenter::present($artwork, 'lg'),
+            ],
+        ]);
+    }
 }

app/Http/Controllers/Api/ArtworkTagController.php

@@ -30,6 +30,7 @@ final class ArtworkTagController extends Controller
 
         $queueConnection = (string) config('queue.default', 'sync');
         $visionEnabled = (bool) config('vision.enabled', true);
+        $autoTaggingEnabled = (bool) config('vision.auto_tagging.enabled', false);
 
         $queuedCount = 0;
         $failedCount = 0;
@@ -56,7 +57,7 @@ final class ArtworkTagController extends Controller
 
         $triggered = false;
         $shouldTrigger = request()->boolean('trigger', false);
-        if ($shouldTrigger && $visionEnabled && ! empty($artwork->hash) && $queuedCount === 0) {
+        if ($shouldTrigger && $visionEnabled && $autoTaggingEnabled && ! empty($artwork->hash) && $queuedCount === 0) {
             AutoTagArtworkJob::dispatch((int) $artwork->id, (string) $artwork->hash);
             $triggered = true;
             $queuedCount = max(1, $queuedCount);
@@ -89,6 +90,7 @@ final class ArtworkTagController extends Controller
                 'queued_jobs' => $queuedCount,
                 'failed_jobs' => $failedCount,
                 'triggered' => $triggered,
+                'auto_tagging_enabled' => $autoTaggingEnabled,
                 'ai_tag_count' => (int) $tags->where('is_ai', true)->count(),
                 'total_tag_count' => (int) $tags->count(),
             ],

app/Http/Controllers/Api/DiscoveryNegativeSignalController.php

@@ -182,10 +182,9 @@ final class DiscoveryNegativeSignalController extends Controller
             return;
         }
 
-        $categoryId = DB::table('artwork_category')
+        $categoryId = DB::table('artworks')
-            ->where('artwork_id', $artworkId)
+            ->where('id', $artworkId)
-            ->orderBy('category_id')
+            ->value('primary_category_id');
-            ->value('category_id');
 
         DB::table('user_discovery_events')->insert([
             'event_id' => (string) Str::uuid(),

app/Http/Controllers/Api/FollowController.php

@@ -5,12 +5,10 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use App\Services\FollowService;
-use App\Support\AvatarUrl;
 use App\Support\UsernamePolicy;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\DB;
 
 /**
  * API endpoints for the follow system.
@@ -72,26 +70,17 @@ final class FollowController extends Controller
     {
         $target  = $this->resolveUser($username);
         $perPage = min((int) $request->query('per_page', 24), 100);
+        $page = max(1, (int) $request->query('page', 1));
 
-        $rows = DB::table('user_followers as uf')
+        $rows = $this->followService
-            ->join('users as u', 'u.id', '=', 'uf.follower_id')
+            ->paginatedFollowers((int) $target->id, $perPage, $page)
-            ->leftJoin('user_profiles as up', 'up.user_id', '=', 'u.id')
+            ->through(fn (array $row) => [
-            ->where('uf.user_id', $target->id)
+                'id'           => $row['id'],
-            ->whereNull('u.deleted_at')
+                'username'     => $row['username'],
-            ->orderByDesc('uf.created_at')
+                'display_name' => $row['display_name'],
-            ->select([
+                'avatar_url'   => $row['avatar_url'],
-                'u.id', 'u.username', 'u.name',
+                'profile_url'  => $row['profile_url'],
-                'up.avatar_hash',
+                'followed_at'  => $row['followed_at'],
-                'uf.created_at as followed_at',
-            ])
-            ->paginate($perPage)
-            ->through(fn ($row) => [
-                'id'          => $row->id,
-                'username'    => $row->username,
-                'display_name'=> $row->username ?? $row->name,
-                'avatar_url'  => AvatarUrl::forUser((int) $row->id, $row->avatar_hash, 50),
-                'profile_url' => '/@' . strtolower((string) ($row->username ?? $row->id)),
-                'followed_at' => $row->followed_at,
             ]);
 
         return response()->json($rows);
@@ -103,26 +92,17 @@ final class FollowController extends Controller
     {
         $target  = $this->resolveUser($username);
         $perPage = min((int) $request->query('per_page', 24), 100);
+        $page = max(1, (int) $request->query('page', 1));
 
-        $rows = DB::table('user_followers as uf')
+        $rows = $this->followService
-            ->join('users as u', 'u.id', '=', 'uf.user_id')
+            ->paginatedFollowing((int) $target->id, $perPage, $page)
-            ->leftJoin('user_profiles as up', 'up.user_id', '=', 'u.id')
+            ->through(fn (array $row) => [
-            ->where('uf.follower_id', $target->id)
+                'id'           => $row['id'],
-            ->whereNull('u.deleted_at')
+                'username'     => $row['username'],
-            ->orderByDesc('uf.created_at')
+                'display_name' => $row['display_name'],
-            ->select([
+                'avatar_url'   => $row['avatar_url'],
-                'u.id', 'u.username', 'u.name',
+                'profile_url'  => $row['profile_url'],
-                'up.avatar_hash',
+                'followed_at'  => $row['followed_at'],
-                'uf.created_at as followed_at',
-            ])
-            ->paginate($perPage)
-            ->through(fn ($row) => [
-                'id'          => $row->id,
-                'username'    => $row->username,
-                'display_name'=> $row->username ?? $row->name,
-                'avatar_url'  => AvatarUrl::forUser((int) $row->id, $row->avatar_hash, 50),
-                'profile_url' => '/@' . strtolower((string) ($row->username ?? $row->id)),
-                'followed_at' => $row->followed_at,
             ]);
 
         return response()->json($rows);

app/Http/Controllers/Api/LatestCommentsApiController.php

@@ -11,11 +11,21 @@ use App\Services\ThumbnailPresenter;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Str;
 use Carbon\Carbon;
+use Illuminate\Contracts\Pagination\Paginator;
 
 class LatestCommentsApiController extends Controller
 {
     private const PER_PAGE = 20;
 
+    private function paginationMeta(Paginator $paginator): array
+    {
+        return [
+            'current_page' => $paginator->currentPage(),
+            'per_page' => $paginator->perPage(),
+            'has_more' => $paginator->hasMorePages(),
+        ];
+    }
+
     public function index(Request $request): JsonResponse
     {
         $type = $request->query('type', 'all');
@@ -66,15 +76,21 @@ class LatestCommentsApiController extends Controller
                     $cacheKey = 'comments.latest.all.page1';
                     $ttl      = 120; // 2 minutes
 
-                    $paginator = Cache::remember($cacheKey, $ttl, fn () => $query->paginate(self::PER_PAGE));
+                    $paginator = Cache::remember($cacheKey, $ttl, fn () => $query
+                        ->orderByDesc('artwork_comments.id')
+                        ->simplePaginate(self::PER_PAGE));
                 } else {
-                    $paginator = $query->paginate(self::PER_PAGE);
+                    $paginator = $query
+                        ->orderByDesc('artwork_comments.id')
+                        ->simplePaginate(self::PER_PAGE);
                 }
                 break;
         }
 
         if (! isset($paginator)) {
-            $paginator = $query->paginate(self::PER_PAGE);
+            $paginator = $query
+                ->orderByDesc('artwork_comments.id')
+                ->simplePaginate(self::PER_PAGE);
         }
 
         $items = $paginator->getCollection()->map(function (ArtworkComment $c) {
@@ -113,13 +129,7 @@ class LatestCommentsApiController extends Controller
 
         return response()->json([
             'data' => $items,
-            'meta' => [
+            'meta' => $this->paginationMeta($paginator),
-                'current_page' => $paginator->currentPage(),
-                'last_page'    => $paginator->lastPage(),
-                'per_page'     => $paginator->perPage(),
-                'total'        => $paginator->total(),
-                'has_more'     => $paginator->hasMorePages(),
-            ],
         ]);
     }
 }

app/Http/Controllers/Api/LinkPreviewController.php

@@ -53,7 +53,12 @@ class LinkPreviewController extends Controller
             return response()->json(['error' => 'Invalid URL.'], 422);
         }
 
-        // Resolve hostname and block private/loopback IPs (SSRF protection)
+        // Resolve hostname and block private/loopback IPs (SSRF protection).
+        // NOTE: This check is not atomic with Guzzle's own DNS resolution — a
+        // DNS rebinding attack could theoretically pass this check and then
+        // resolve to an internal IP when Guzzle makes the actual request.
+        // Risk is low (requires attacker-controlled DNS with very short TTL),
+        // but this is a known limitation of the current approach.
         $resolved = gethostbyname($host);
         if ($this->isBlockedIp($resolved)) {
             return response()->json(['error' => 'URL not allowed.'], 422);

app/Http/Controllers/Api/Messaging/MessageSearchController.php

@@ -48,10 +48,7 @@ class MessageSearchController extends Controller
         $estimated = 0;
 
         try {
-            $client = new Client(
+            $client = app(Client::class);
-                config('scout.meilisearch.host'),
-                config('scout.meilisearch.key')
-            );
 
             $prefix = (string) config('scout.prefix', '');
             $indexName = $prefix . (string) config('messaging.search.index', 'messages');

app/Http/Controllers/Api/ProfileApiController.php

@@ -7,9 +7,11 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Models\Artwork;
 use App\Models\User;
-use Carbon\CarbonInterface;
+use App\Services\CollectionService;
+use App\Services\Maturity\ArtworkMaturityService;
 use App\Services\ThumbnailPresenter;
 use App\Support\UsernamePolicy;
+use Carbon\CarbonInterface;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -25,6 +27,28 @@ use UnexpectedValueException;
  */
 final class ProfileApiController extends Controller
 {
+    public function __construct(private readonly CollectionService $collections) {}
+
+    /**
+     * GET /api/profile/{username}/collections
+     * Returns the profile collection cards without rendering the profile page.
+     */
+    public function collections(Request $request, string $username): JsonResponse
+    {
+        $user = $this->resolveUser($username);
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        $viewer = $request->user();
+        $isOwner = $viewer && (int) $viewer->id === (int) $user->id;
+        $profileCollections = $this->collections->getProfileCollections($user, $viewer);
+
+        return response()->json([
+            'data' => $this->collections->mapCollectionCardPayloads($profileCollections, $isOwner, $viewer),
+        ]);
+    }
+
     /**
      * GET /api/profile/{username}/artworks
      * Returns cursor-paginated artworks for the profile page tabs.
@@ -106,16 +130,20 @@ final class ProfileApiController extends Controller
             return response()->json(['error' => 'User not found'], 404);
         }
 
-        $perPage = 24;
+        $perPage = 12;
         $offset = max(0, (int) base64_decode((string) $request->input('cursor', ''), true));
 
-        $favIds = DB::table($favouriteTable . ' as af')
+        $favIds = DB::table($favouriteTable.' as af')
             ->join('artworks as a', 'a.id', '=', 'af.artwork_id')
             ->where('af.user_id', $user->id)
             ->whereNull('a.deleted_at')
             ->where('a.is_public', true)
             ->where('a.is_approved', true)
             ->whereNotNull('a.published_at')
+            ->when(app(ArtworkMaturityService::class)->viewerPreferences($request->user())['visibility'] === ArtworkMaturityService::VIEW_HIDE, function ($query): void {
+                $query->whereRaw('COALESCE(a.is_mature, 0) = 0')
+                    ->whereRaw("COALESCE(a.maturity_status, 'clear') != ?", [ArtworkMaturityService::STATUS_SUSPECTED]);
+            })
             ->orderByDesc('af.created_at')
             ->orderByDesc('af.artwork_id')
             ->offset($offset)
@@ -185,6 +213,7 @@ final class ProfileApiController extends Controller
     private function resolveUser(string $username): ?User
     {
         $normalized = UsernamePolicy::normalize($username);
+
         return User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
     }
 
@@ -213,7 +242,7 @@ final class ProfileApiController extends Controller
             return $query
                 ->leftJoin('artwork_stats as profile_artwork_stats', 'profile_artwork_stats.artwork_id', '=', 'artworks.id')
                 ->select('artworks.*')
-                ->selectRaw('COALESCE(' . $statsColumn . ', 0) as cursor_sort_value')
+                ->selectRaw('COALESCE('.$statsColumn.', 0) as cursor_sort_value')
                 ->orderByDesc('cursor_sort_value')
                 ->orderByDesc('published_at')
                 ->orderByDesc('id');
@@ -230,7 +259,7 @@ final class ProfileApiController extends Controller
     private function mapArtworkCardPayload(Artwork $art): array
     {
         $present = ThumbnailPresenter::present($art, 'md');
-        $category = $art->categories->first();
+        $category = $art->resolvedPrimaryCategory();
         $contentType = $category?->contentType;
         $stats = $art->stats;
         $group = $art->group;
@@ -240,12 +269,14 @@ final class ProfileApiController extends Controller
         $avatarUrl = $isGroupPublisher ? $group->avatarUrl() : ($art->user?->profile?->avatar_url ?? null);
         $profileUrl = $isGroupPublisher
             ? $group->publicUrl()
-            : ($username ? '/@' . $username : null);
+            : ($username ? '/@'.$username : null);
         $publisherType = $isGroupPublisher ? 'group' : 'user';
 
         return [
             'id' => $art->id,
             'name' => $art->title,
+            'picture' => $art->file_name,
+            'datum' => $this->formatIsoDate($art->published_at),
             'thumb' => $present['url'],
             'thumb_srcset' => $present['srcset'] ?? $present['url'],
             'width' => $art->width,

app/Http/Controllers/Api/SimilarAiArtworksController.php

@@ -6,10 +6,12 @@ namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Models\Artwork;
+use App\Services\Vision\VectorGatewayException;
 use App\Services\Vision\VectorService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use RuntimeException;
+use Illuminate\Support\Facades\Log;
+use Throwable;
 
 final class SimilarAiArtworksController extends Controller
 {
@@ -35,11 +37,12 @@ final class SimilarAiArtworksController extends Controller
 
         try {
             $items = $this->vectors->similarToArtwork($artwork, $limit);
-        } catch (RuntimeException $e) {
+        } catch (Throwable $e) {
+            $this->logSimilarityFailure($artwork->id, $e);
+
             return response()->json([
                 'data' => [],
                 'reason' => 'vector_gateway_error',
-                'message' => $e->getMessage(),
             ], 502);
         }
 
@@ -52,4 +55,19 @@ final class SimilarAiArtworksController extends Controller
             ],
         ]);
     }
+
+    private function logSimilarityFailure(int $artworkId, Throwable $e): void
+    {
+        $gateway = $e instanceof VectorGatewayException ? $e : null;
+
+        Log::warning('Vector similarity search failed', [
+            'artwork_id' => $artworkId,
+            'route' => 'api.art.similar-ai',
+            'failure_stage' => $gateway?->operation ?? 'unknown',
+            'exception_class' => $e::class,
+            'http_status' => $gateway?->httpStatus,
+            'circuit_worthy' => $gateway?->circuitWorthy ?? false,
+            'circuit_open' => app(\App\Services\Vision\VectorGatewayClient::class)->circuitOpen(),
+        ]);
+    }
 }

app/Http/Controllers/Api/UploadController.php

@@ -5,50 +5,58 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Uploads\UploadCancelRequest;
+use App\Http\Requests\Uploads\UploadChunkRequest;
 use App\Http\Requests\Uploads\UploadFinishRequest;
 use App\Http\Requests\Uploads\UploadInitRequest;
-use App\Http\Requests\Uploads\UploadChunkRequest;
-use App\Http\Requests\Uploads\UploadCancelRequest;
 use App\Http\Requests\Uploads\UploadStatusRequest;
-use App\Jobs\GenerateDerivativesJob;
 use App\Jobs\AnalyzeArtworkAiAssistJob;
-use App\Jobs\IndexArtworkJob;
 use App\Jobs\AutoTagArtworkJob;
 use App\Jobs\DetectArtworkMaturityJob;
 use App\Jobs\GenerateArtworkEmbeddingJob;
+use App\Jobs\GenerateDerivativesJob;
+use App\Jobs\IndexArtworkJob;
+use App\Models\ActivityEvent;
+use App\Models\Artwork;
+use App\Models\Group;
+use App\Models\Tag;
+use App\Notifications\NewArtworkReviewNotification;
 use App\Repositories\Uploads\UploadSessionRepository;
-use App\Services\Uploads\UploadChunkService;
-use App\Services\Uploads\UploadCancelService;
-use App\Services\Uploads\UploadAuditService;
-use App\Services\Uploads\UploadPipelineService;
-use App\Services\Uploads\UploadQuotaService;
-use App\Services\Uploads\UploadQueueService;
-use App\Services\Uploads\UploadSessionStatus;
-use App\Services\Uploads\UploadStatusService;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Log;
-use Symfony\Component\HttpFoundation\Response;
-use Throwable;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Validator;
-use App\Services\Upload\Contracts\UploadDraftServiceInterface;
-use Carbon\Carbon;
-use App\Uploads\Jobs\VirusScanJob;
-use App\Uploads\Services\PublishService;
 use App\Services\Activity\UserActivityService;
 use App\Services\ArtworkAttributionService;
+use App\Services\Artworks\ArtworkCategoryService;
+use App\Services\GroupArtworkReviewService;
 use App\Services\Maturity\ArtworkMaturityService;
+use App\Services\Moderation\ArtworkUploadPolicy;
+use App\Services\Upload\Contracts\UploadDraftServiceInterface;
+use App\Services\Uploads\UploadAuditService;
+use App\Services\Uploads\UploadCancelService;
+use App\Services\Uploads\UploadChunkService;
+use App\Services\Uploads\UploadPipelineService;
+use App\Services\Uploads\UploadQueueService;
+use App\Services\Uploads\UploadQuotaService;
+use App\Services\Uploads\UploadSessionStatus;
+use App\Services\Uploads\UploadStatusService;
+use App\Services\Worlds\WorldSubmissionService;
+use App\Support\ArtworkDescriptionContentValidator;
+use App\Uploads\Exceptions\DraftQuotaException;
 use App\Uploads\Exceptions\UploadNotFoundException;
 use App\Uploads\Exceptions\UploadOwnershipException;
 use App\Uploads\Exceptions\UploadPublishValidationException;
+use App\Uploads\Jobs\VirusScanJob;
 use App\Uploads\Services\ArchiveInspectorService;
 use App\Uploads\Services\DraftQuotaService;
-use App\Uploads\Exceptions\DraftQuotaException;
+use App\Uploads\Services\PublishService;
-use App\Models\Artwork;
+use Carbon\Carbon;
-use App\Models\Group;
+use Illuminate\Http\Request;
-use App\Services\GroupArtworkReviewService;
+use Illuminate\Support\Facades\DB;
-use App\Services\Worlds\WorldSubmissionService;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+use Symfony\Component\HttpFoundation\Response;
+use Throwable;
 
 final class UploadController extends Controller
 {
@@ -57,8 +65,7 @@ final class UploadController extends Controller
         UploadPipelineService $pipeline,
         UploadQuotaService $quota,
         UploadAuditService $audit
-    )
+    ) {
-    {
         $user = $request->user();
 
         try {
@@ -237,10 +244,19 @@ final class UploadController extends Controller
                 }
 
                 // Derivatives are available now; dispatch AI auto-tagging.
+                if ((bool) config('vision.auto_tagging.enabled', false)) {
                     AutoTagArtworkJob::dispatch($artworkId, $validated->hash)->afterCommit();
+                }
+                if ((bool) config('vision.upload.maturity.enabled', false)) {
                     DetectArtworkMaturityJob::dispatch($artworkId, $validated->hash)->afterCommit();
+                }
+                if ((bool) config('vision.upload.embeddings.enabled', true)) {
                     GenerateArtworkEmbeddingJob::dispatch($artworkId, $validated->hash)->afterCommit();
+                }
+                if ((bool) config('vision.upload.ai_assist.enabled', false)) {
                     AnalyzeArtworkAiAssistJob::dispatch($artworkId)->afterCommit();
+                }
+
                 return UploadSessionStatus::PROCESSED;
             });
 
@@ -295,7 +311,7 @@ final class UploadController extends Controller
                     'realpath' => $chunkFile->getRealPath(),
                 ]);
             }
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Chunk upload debug logging failed', ['error' => $e->getMessage()]);
         }
 
@@ -323,7 +339,7 @@ final class UploadController extends Controller
                 'total_bytes' => $result->totalBytes,
                 'progress' => $result->progress,
             ], Response::HTTP_OK);
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Upload chunk failed', [
                 'session_id' => (string) $request->input('session_id'),
                 'error' => $e->getMessage(),
@@ -373,7 +389,7 @@ final class UploadController extends Controller
                 'session_id' => $result['session_id'],
                 'status' => $result['status'],
             ], Response::HTTP_OK);
-        } catch (\Throwable $e) {
+        } catch (Throwable $e) {
             logger()->warning('Upload cancel failed', [
                 'session_id' => (string) $request->input('session_id'),
                 'error' => $e->getMessage(),
@@ -502,6 +518,7 @@ final class UploadController extends Controller
             return response()->json($response, Response::HTTP_OK);
         } catch (Throwable $e) {
             logger()->error('Upload preload failed', ['error' => $e->getMessage()]);
+
             return response()->json(['message' => 'Preload failed.'], Response::HTTP_INTERNAL_SERVER_ERROR);
         }
     }
@@ -528,14 +545,18 @@ final class UploadController extends Controller
         $validated = $request->validate([
             'title' => ['nullable', 'string', 'max:255'],
             'category_id' => ['nullable', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
             'description' => ['nullable', 'string'],
             'tags' => ['nullable', 'array'],
             'license' => ['nullable', 'string'],
             'nsfw' => ['nullable', 'boolean'],
         ]);
 
+        $this->ensureValidArtworkDescription($validated);
+
         $updates = [];
-        foreach (['title', 'category_id', 'description', 'tags', 'license', 'nsfw'] as $field) {
+        foreach (['title', 'category_id', 'secondary_category_ids', 'description', 'tags', 'license', 'nsfw'] as $field) {
             if (array_key_exists($field, $validated)) {
                 $updates[$field] = $validated[$field];
             }
@@ -545,7 +566,7 @@ final class UploadController extends Controller
         foreach ($updates as $field => $value) {
             $current = $upload->{$field} ?? null;
 
-            if ($field === 'tags') {
+            if ($field === 'tags' || $field === 'secondary_category_ids') {
                 $current = $current ? json_decode((string) $current, true) : null;
             }
 
@@ -563,6 +584,10 @@ final class UploadController extends Controller
             $dirty['tags'] = json_encode($dirty['tags']);
         }
 
+        if (array_key_exists('secondary_category_ids', $dirty)) {
+            $dirty['secondary_category_ids'] = json_encode($dirty['secondary_category_ids']);
+        }
+
         if (! empty($dirty)) {
             $dirty['updated_at'] = now();
             DB::table('uploads')->where('id', $id)->update($dirty);
@@ -604,7 +629,7 @@ final class UploadController extends Controller
         ], Response::HTTP_OK);
     }
 
-    public function publish(string $id, Request $request, PublishService $publishService, ArtworkAttributionService $attribution, ArtworkMaturityService $maturity, WorldSubmissionService $submissions)
+    public function publish(string $id, Request $request, PublishService $publishService, ArtworkAttributionService $attribution, ArtworkMaturityService $maturity, WorldSubmissionService $submissions, ArtworkUploadPolicy $uploadPolicy)
     {
         $user = $request->user();
 
@@ -612,7 +637,10 @@ final class UploadController extends Controller
             'title' => ['nullable', 'string', 'max:150'],
             'description' => ['nullable', 'string'],
             'category' => ['nullable', 'integer', 'exists:categories,id'],
-            'tags'        => ['nullable', 'array', 'max:' . (int) config('tags.max_user_tags', 30)],
+            'primary_category_id' => ['nullable', 'integer', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
+            'tags' => ['nullable', 'array', 'max:'.(int) config('tags.max_user_tags', 30)],
             'tags.*' => ['string', 'max:64'],
             'is_mature' => ['nullable', 'boolean'],
             'nsfw' => ['nullable', 'boolean'],
@@ -635,6 +663,8 @@ final class UploadController extends Controller
             'world_submissions.*.source_surface' => ['nullable', 'string', 'max:80'],
         ]);
 
+        $this->ensureValidArtworkDescription($validated);
+
         $mode = $validated['mode'] ?? 'now';
         $visibility = $validated['visibility'] ?? 'public';
 
@@ -642,14 +672,14 @@ final class UploadController extends Controller
         $publishAt = null;
         if ($mode === 'schedule' && ! empty($validated['publish_at'])) {
             try {
-                $publishAt = \Carbon\Carbon::parse($validated['publish_at'])->utc();
+                $publishAt = Carbon::parse($validated['publish_at'])->utc();
                 // Must be at least 1 minute in the future (server-side guard)
                 if ($publishAt->lte(now()->addMinute())) {
                     return response()->json([
                         'message' => 'Scheduled publish time must be at least 1 minute in the future.',
                     ], Response::HTTP_UNPROCESSABLE_ENTITY);
                 }
-            } catch (\Throwable) {
+            } catch (Throwable) {
                 return response()->json(['message' => 'Invalid publish_at datetime.'], Response::HTTP_UNPROCESSABLE_ENTITY);
             }
         }
@@ -687,17 +717,20 @@ final class UploadController extends Controller
             $artwork->uploaded_by_user_id = $artwork->uploaded_by_user_id ?: (int) $user->id;
             $artwork->primary_author_user_id = $artwork->primary_author_user_id ?: (int) $user->id;
 
-            // Sync category if provided
+            $categoryId = isset($validated['primary_category_id'])
-            $categoryId = isset($validated['category']) ? (int) $validated['category'] : null;
+                ? (int) $validated['primary_category_id']
-            if ($categoryId && \App\Models\Category::where('id', $categoryId)->exists()) {
+                : (isset($validated['category']) ? (int) $validated['category'] : null);
-                $artwork->categories()->sync([$categoryId]);
+            $secondaryCategoryIds = array_values(array_map('intval', $validated['secondary_category_ids'] ?? []));
+            if ($categoryId) {
+                app(ArtworkCategoryService::class)
+                    ->sync($artwork, $categoryId, $secondaryCategoryIds, 'user', false);
             }
 
             // Sync tags if provided
-            if (!empty($validated['tags']) && is_array($validated['tags'])) {
+            if (! empty($validated['tags']) && is_array($validated['tags'])) {
                 $tagIds = [];
                 foreach ($validated['tags'] as $tagSlug) {
-                    $tag = \App\Models\Tag::firstOrCreate(
+                    $tag = Tag::firstOrCreate(
                         ['slug' => Str::slug($tagSlug)],
                         ['name' => $tagSlug, 'is_active' => true, 'usage_count' => 0]
                     );
@@ -733,10 +766,47 @@ final class UploadController extends Controller
                 ], Response::HTTP_OK);
             }
 
-            // Publish immediately
+            // New and suspicious accounts are quarantined. Never let the client
+            // decide that an artwork is approved.
+            $policy = $uploadPolicy->assess($user, $artwork);
+            if ($policy['requires_review']) {
+                $artwork->visibility = $visibility;
+                $artwork->is_public = false;
+                $artwork->is_approved = false;
+                $artwork->approval_source = null;
+                $artwork->artwork_status = 'review';
+                $artwork->published_at = null;
+                $artwork->publish_at = null;
+                $artwork->moderated_at = null;
+                $artwork->moderated_by = null;
+                $artwork->moderation_note = implode(', ', $policy['reasons']);
+                $artwork->save();
+
+                $notifyEmail = trim((string) config('uploads.moderation.notify_email', ''));
+                if ($notifyEmail !== '') {
+                    try {
+                        Notification::route('mail', $notifyEmail)->notify(
+                            new NewArtworkReviewNotification($artwork, $user, $policy['reasons'])
+                        );
+                    } catch (Throwable) {
+                        // Email failure must not expose the artwork.
+                    }
+                }
+
+                return response()->json([
+                    'success' => true,
+                    'artwork_id' => (int) $artwork->id,
+                    'status' => 'submitted_for_review',
+                    'message' => 'Upload received and queued for moderation.',
+                    'review_reasons' => $policy['reasons'],
+                ], Response::HTTP_OK);
+            }
+
+            // Publish immediately for trusted users only.
             $artwork->visibility = $visibility;
             $artwork->is_public = ($visibility !== 'private');
             $artwork->is_approved = true;
+            $artwork->approval_source = 'trusted_auto';
             $artwork->published_at = now();
             $artwork->artwork_status = 'published';
             $artwork->publish_at = null;
@@ -746,17 +816,19 @@ final class UploadController extends Controller
 
             // Record upload activity event
             try {
-                \App\Models\ActivityEvent::record(
+                ActivityEvent::record(
                     actorId: (int) $user->id,
-                    type:       \App\Models\ActivityEvent::TYPE_UPLOAD,
+                    type: ActivityEvent::TYPE_UPLOAD,
-                    targetType: \App\Models\ActivityEvent::TARGET_ARTWORK,
+                    targetType: ActivityEvent::TARGET_ARTWORK,
                     targetId: (int) $artwork->id,
                 );
-            } catch (\Throwable) {}
+            } catch (Throwable) {
+            }
 
             try {
                 app(UserActivityService::class)->logUpload((int) $user->id, (int) $artwork->id);
-            } catch (\Throwable) {}
+            } catch (Throwable) {
+            }
 
             return response()->json([
                 'success' => true,
@@ -794,7 +866,10 @@ final class UploadController extends Controller
             'title' => ['nullable', 'string', 'max:150'],
             'description' => ['nullable', 'string'],
             'category' => ['nullable', 'integer', 'exists:categories,id'],
-            'tags' => ['nullable', 'array', 'max:' . (int) config('tags.max_user_tags', 30)],
+            'primary_category_id' => ['nullable', 'integer', 'exists:categories,id'],
+            'secondary_category_ids' => ['nullable', 'array', 'max:'.(int) config('categories.max_secondary_categories', 5)],
+            'secondary_category_ids.*' => ['integer', 'exists:categories,id'],
+            'tags' => ['nullable', 'array', 'max:'.(int) config('tags.max_user_tags', 30)],
             'tags.*' => ['string', 'max:64'],
             'is_mature' => ['nullable', 'boolean'],
             'nsfw' => ['nullable', 'boolean'],
@@ -814,6 +889,8 @@ final class UploadController extends Controller
             'world_submissions.*.source_surface' => ['nullable', 'string', 'max:80'],
         ]);
 
+        $this->ensureValidArtworkDescription($validated);
+
         if (! ctype_digit($id)) {
             return response()->json(['message' => 'Artwork review submission requires an artwork draft id.'], Response::HTTP_UNPROCESSABLE_ENTITY);
         }
@@ -842,4 +919,13 @@ final class UploadController extends Controller
             'group_review_status' => (string) $artwork->group_review_status,
         ], Response::HTTP_OK);
     }
+
+    private function ensureValidArtworkDescription(array $validated): void
+    {
+        foreach (ArtworkDescriptionContentValidator::errors($validated['description'] ?? null) as $message) {
+            throw ValidationException::withMessages([
+                'description' => [$message],
+            ]);
+        }
+    }
 }

app/Http/Controllers/ArtworkDownloadController.php

@@ -8,11 +8,13 @@ use App\Models\Artwork;
 use App\Models\ArtworkDownload;
 use App\Services\ArtworkOriginalFileLocator;
 use App\Services\ArtworkStatsService;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 
@@ -43,19 +45,76 @@ final class ArtworkDownloadController extends Controller
         private readonly ArtworkOriginalFileLocator $originalFiles,
     ) {}
 
-    public function __invoke(Request $request, int $id): BinaryFileResponse|Response
+    public function __invoke(Request $request, int $id): BinaryFileResponse|RedirectResponse|Response
     {
         $artwork = Artwork::query()->find($id);
 
         if (! $artwork) {
-            abort(404);
+            return $this->notFound();
         }
 
-        $filePath = $this->originalFiles->resolveLocalPath($artwork);
+        $resolution = $this->originalFiles->resolve($artwork);
-        $ext = strtolower(ltrim((string) pathinfo($filePath, PATHINFO_EXTENSION), '.'));
+        $filePath = (string) $resolution['path'];
+        $objectKey = (string) $resolution['object_key'];
+        $ext = strtolower((string) ($resolution['file_ext'] ?: pathinfo($filePath !== '' ? $filePath : $objectKey, PATHINFO_EXTENSION)));
 
-        if ($filePath === '' || ! in_array($ext, self::ALLOWED_EXTENSIONS, true)) {
+        if (($filePath === '' && $objectKey === '') || ! in_array($ext, self::ALLOWED_EXTENSIONS, true)) {
-            abort(404);
+            return $this->notFound();
+        }
+
+        if (! $resolution['exists']) {
+            Log::warning('Artwork original file missing for download.', [
+                'artwork_id' => $artwork->id,
+                'ext' => $ext,
+                'download_status' => $artwork->download_status,
+                'canonical_local_exists' => $filePath !== '' && File::isFile($filePath),
+                'object_exists' => false,
+                'resolution_status' => $resolution['status'],
+            ]);
+
+            return $this->notFound();
+        }
+
+        $downloadName = $this->buildDownloadFilename((string) $artwork->file_name, $ext);
+        $temporaryUrl = null;
+
+        if ($resolution['source'] === 'object') {
+            try {
+                $temporaryUrl = Storage::disk((string) $resolution['disk'])->temporaryUrl(
+                    $objectKey,
+                    now()->addMinutes(5),
+                    [
+                        'ResponseContentDisposition' => 'attachment; filename="'.addslashes($downloadName).'"',
+                    ],
+                );
+            } catch (\Throwable $exception) {
+                Log::warning('Artwork object temporary URL generation failed.', [
+                    'artwork_id' => $artwork->id,
+                    'disk' => $resolution['disk'],
+                    'object_key' => $objectKey,
+                    'object_exists' => true,
+                    'object_size' => $resolution['size'],
+                    'exception_class' => $exception::class,
+                    'exception_message' => mb_substr($exception->getMessage(), 0, 300),
+                ]);
+
+                return $this->notFound();
+            }
+
+            if (! is_string($temporaryUrl) || trim($temporaryUrl) === '') {
+                Log::warning('Artwork object temporary URL generation failed.', [
+                    'artwork_id' => $artwork->id,
+                    'disk' => $resolution['disk'],
+                    'object_key' => $objectKey,
+                    'resolution_status' => $resolution['status'],
+                    'object_exists' => true,
+                    'object_size' => $resolution['size'],
+                    'exception_class' => 'InvalidTemporaryUrl',
+                    'exception_message' => 'Storage adapter did not return a temporary URL.',
+                ]);
+
+                return $this->notFound();
+            }
         }
 
         $this->recordDownload($request, $artwork->id);
@@ -70,18 +129,14 @@ final class ArtworkDownloadController extends Controller
             ]);
         }
 
-        if (! File::isFile($filePath)) {
+        if (array_key_exists('download_status', $artwork->getAttributes())) {
-            Log::warning('Artwork original file missing for download.', [
+            $artwork->forceFill([
-                'artwork_id' => $artwork->id,
+                'download_status' => 'available',
-                'ext' => $ext,
+                'download_source' => $resolution['source'],
-                'resolved_path' => $filePath,
+                'download_checked_at' => now(),
-            ]);
+            ])->saveQuietly();
-
-            abort(404);
         }
 
-        $downloadName = $this->buildDownloadFilename((string) $artwork->file_name, $ext);
-
         // X-Accel-Redirect is safe only when nginx is explicitly configured to
         // map the internal URI to the originals root. Otherwise fallback to the
         // normal Laravel download response.
@@ -90,14 +145,26 @@ final class ArtworkDownloadController extends Controller
             return response('', 200, [
                 'X-Accel-Redirect' => $accelUri,
                 'Content-Type' => 'application/octet-stream',
-                'Content-Disposition' => 'attachment; filename="' . addslashes($downloadName) . '"',
+                'Content-Disposition' => 'attachment; filename="'.addslashes($downloadName).'"',
                 'X-Content-Type-Options' => 'nosniff',
             ]);
         }
 
+        if ($resolution['source'] === 'object') {
+            return redirect()->away($temporaryUrl);
+        }
+
         return response()->download($filePath, $downloadName);
     }
 
+    private function notFound(): Response
+    {
+        return response('', 404, [
+            'Content-Type' => 'text/plain; charset=UTF-8',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
     private function resolveAccelUri(string $filePath): ?string
     {
         if (! config('app.download_accel_enabled')) {
@@ -116,7 +183,7 @@ final class ArtworkDownloadController extends Controller
 
         $normalizedRoot = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $root);
         $normalizedFilePath = str_replace(['/', '\\'], DIRECTORY_SEPARATOR, $filePath);
-        $rootPrefix = $normalizedRoot . DIRECTORY_SEPARATOR;
+        $rootPrefix = $normalizedRoot.DIRECTORY_SEPARATOR;
 
         if (! str_starts_with($normalizedFilePath, $rootPrefix)) {
             Log::warning('Artwork download accel path skipped because file is outside originals root.', [
@@ -132,7 +199,7 @@ final class ArtworkDownloadController extends Controller
             return null;
         }
 
-        return $accelBase . str_replace(DIRECTORY_SEPARATOR, '/', $relativePath);
+        return $accelBase.str_replace(DIRECTORY_SEPARATOR, '/', $relativePath);
     }
 
     private function recordDownload(Request $request, int $artworkId): void
@@ -187,10 +254,10 @@ final class ArtworkDownloadController extends Controller
         $brandSuffix = $this->downloadBrandSuffix();
 
         if ($brandSuffix !== '' && ! Str::contains(Str::lower($baseName), Str::lower($brandSuffix))) {
-            $baseName .= ' (' . $brandSuffix . ')';
+            $baseName .= ' ('.$brandSuffix.')';
         }
 
-        return $baseName . '.' . $ext;
+        return $baseName.'.'.$ext;
     }
 
     private function downloadBrandSuffix(): string

app/Http/Controllers/ArtworkEnhanceController.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use App\Models\Artwork;
+use App\Services\Enhance\EnhanceService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use RuntimeException;
+
+final class ArtworkEnhanceController extends Controller
+{
+    public function __construct(
+        private readonly EnhanceService $enhanceService,
+    ) {
+    }
+
+    public function store(Request $request, int $artwork): RedirectResponse
+    {
+        $artwork = Artwork::query()->findOrFail($artwork);
+
+        $actor = $request->user();
+        abort_unless($actor !== null, 403);
+
+        $isOwner = (int) $artwork->user_id === (int) $actor->id;
+        $isStaff = $actor->isAdmin() || $actor->isModerator();
+
+        abort_unless($isOwner || $isStaff, 403);
+
+        $validated = $request->validate([
+            'scale' => ['required', 'integer', Rule::in((array) config('enhance.allowed_scales', [2, 4]))],
+            'mode' => ['required', 'string', Rule::in((array) config('enhance.allowed_modes', ['standard', 'artwork', 'photo', 'illustration']))],
+        ]);
+
+        try {
+            $job = $this->enhanceService->createFromArtwork($actor, $artwork, $validated);
+        } catch (RuntimeException $exception) {
+            return redirect()
+                ->route('enhance.create', ['artwork' => $artwork->id])
+                ->withErrors([
+                    'source' => $exception->getMessage(),
+                ]);
+        }
+
+        return redirect()
+            ->route('enhance.show', ['enhanceJob' => $job])
+            ->with('success', 'Artwork enhance job created.');
+    }
+}

app/Http/Controllers/Auth/RegisteredUserController.php

@@ -42,6 +42,7 @@ class RegisteredUserController extends Controller
 
         return view('auth.register', [
             'prefillEmail' => (string) $request->query('email', ''),
+            'page_canonical' => route('register'),
             'turnstile' => [
                 'enabled' => $this->turnstileVerifier->isEnabled(),
                 'siteKey' => $this->turnstileVerifier->siteKey(),

app/Http/Controllers/BuildInfoController.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+
+final class BuildInfoController extends Controller
+{
+    public function __invoke(): JsonResponse
+    {
+        $path = base_path('build-info.json');
+
+        if (! is_file($path) || ! is_readable($path)) {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        $decoded = json_decode((string) file_get_contents($path), true);
+
+        if (! is_array($decoded)) {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        $commit = trim((string) ($decoded['git_sha'] ?? ''));
+        $release = trim((string) ($decoded['release_id'] ?? ''));
+        $builtAt = trim((string) ($decoded['deployed_at_utc'] ?? ''));
+
+        if ($commit === '' || $release === '' || $builtAt === '') {
+            return response()->json(['error' => 'Build info unavailable'], 404)
+                ->header('Cache-Control', 'no-store, max-age=0');
+        }
+
+        return response()->json([
+            'environment' => app()->environment(),
+            'commit' => $commit,
+            'built_at' => $builtAt,
+            'release' => $release,
+        ])->header('Cache-Control', 'no-store, max-age=0');
+    }
+}

app/Http/Controllers/Community/LatestCommentsController.php

@@ -10,11 +10,21 @@ use App\Services\ThumbnailPresenter;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Str;
 use Carbon\Carbon;
+use Illuminate\Contracts\Pagination\Paginator;
 
 class LatestCommentsController extends Controller
 {
     private const PER_PAGE = 20;
 
+    private function paginationMeta(Paginator $paginator): array
+    {
+        return [
+            'current_page' => $paginator->currentPage(),
+            'per_page' => $paginator->perPage(),
+            'has_more' => $paginator->hasMorePages(),
+        ];
+    }
+
     public function index(Request $request)
     {
         $page_title = 'Latest Comments';
@@ -38,7 +48,8 @@ class LatestCommentsController extends Controller
                     $q->public()->published()->whereNull('deleted_at');
                 })
                 ->orderByDesc('artwork_comments.created_at')
-                ->paginate(self::PER_PAGE);
+                ->orderByDesc('artwork_comments.id')
+                ->simplePaginate(self::PER_PAGE);
         });
 
         $items = $initialData->getCollection()->map(function (ArtworkComment $c) {
@@ -76,13 +87,7 @@ class LatestCommentsController extends Controller
 
         $props = [
             'initialComments' => $items->values()->all(),
-            'initialMeta'     => [
+            'initialMeta'     => $this->paginationMeta($initialData),
-                'current_page' => $initialData->currentPage(),
-                'last_page'    => $initialData->lastPage(),
-                'per_page'     => $initialData->perPage(),
-                'total'        => $initialData->total(),
-                'has_more'     => $initialData->hasMorePages(),
-            ],
             'isAuthenticated' => (bool) auth()->user(),
         ];
 

app/Http/Controllers/Dashboard/ManageController.php

@@ -3,12 +3,14 @@
 namespace App\Http\Controllers\Dashboard;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Manage\ManageArtworkDestroyRequest;
 use App\Http\Requests\Manage\ManageArtworkEditRequest;
 use App\Http\Requests\Manage\ManageArtworkUpdateRequest;
-use App\Http\Requests\Manage\ManageArtworkDestroyRequest;
+use App\Models\Artwork;
+use App\Services\Artworks\ArtworkCategoryService;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
 
 class ManageController extends Controller
 {
@@ -17,14 +19,12 @@ class ManageController extends Controller
         $userId = $request->user()->id;
         $perPage = 50;
 
-        $categorySub = DB::table('artwork_category as ac')
+        $categorySub = DB::table('categories as c')
-            ->join('categories as c', 'ac.category_id', '=', 'c.id')
+            ->select('c.id as category_id', 'c.name as category_name');
-            ->select('ac.artwork_id', DB::raw('MIN(c.name) as category_name'))
-            ->groupBy('ac.artwork_id');
 
         $query = DB::table('artworks as a')
             ->leftJoinSub($categorySub, 'cat', function ($join) {
-                $join->on('a.id', '=', 'cat.artwork_id');
+                $join->on('a.primary_category_id', '=', 'cat.category_id');
             })
             ->leftJoin('artwork_stats as s', 'a.id', '=', 's.artwork_id')
             ->where('a.user_id', $userId)
@@ -52,8 +52,8 @@ class ManageController extends Controller
     {
         $artwork = $request->artwork();
 
-        $selectedCategory = DB::table('artwork_category')->where('artwork_id', (int)$id)->value('category_id');
+        $selectedCategory = (int) ($artwork->primary_category_id ?: DB::table('artwork_category')->where('artwork_id', (int) $id)->value('category_id'));
-        $artwork->category = $selectedCategory;
+        $artwork->category = $selectedCategory ?: null;
 
         $categories = DB::table('categories')
             ->where('content_type_id', 0)
@@ -64,7 +64,7 @@ class ManageController extends Controller
         return view('manage.edit', [
             'artwork' => $artwork,
             'categories' => $categories,
-            'page_title' => 'Edit Artwork: ' . ($artwork->title ?? ''),
+            'page_title' => 'Edit Artwork: '.($artwork->title ?? ''),
         ]);
     }
 
@@ -91,14 +91,14 @@ class ManageController extends Controller
             $update['fname'] = basename($attPath);
         }
 
-        DB::table('artworks')->where('id', (int)$id)->update($update);
+        DB::table('artworks')->where('id', (int) $id)->update($update);
 
         if (isset($data['section'])) {
-            DB::table('artwork_category')->where('artwork_id', (int)$id)->delete();
+            $model = Artwork::query()->find((int) $id);
-            DB::table('artwork_category')->insert([
+            if ($model) {
-                'artwork_id' => (int)$id,
+                app(ArtworkCategoryService::class)
-                'category_id' => (int)$data['section'],
+                    ->sync($model, (int) $data['section'], [], 'moderator');
-            ]);
+            }
         }
 
         return redirect()->route('manage')->with('status', 'Artwork was successfully updated.');
@@ -108,14 +108,14 @@ class ManageController extends Controller
     {
         $artwork = $request->artwork();
 
-        if (!empty($artwork->fname)) {
+        if (! empty($artwork->fname)) {
-            Storage::delete('public/uploads/attachments/' . $artwork->fname);
+            Storage::delete('public/uploads/attachments/'.$artwork->fname);
         }
-        if (!empty($artwork->picture)) {
+        if (! empty($artwork->picture)) {
-            Storage::delete('public/uploads/artworks/' . $artwork->picture);
+            Storage::delete('public/uploads/artworks/'.$artwork->picture);
         }
 
-        DB::table('artworks')->where('id', (int)$id)->delete();
+        DB::table('artworks')->where('id', (int) $id)->delete();
 
         return redirect()->route('manage')->with('status', 'Artwork deleted.');
     }

app/Http/Controllers/EnhanceController.php

@@ -0,0 +1,208 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers;
+
+use App\Models\Artwork;
+use App\Models\EnhanceJob;
+use App\Services\Enhance\EnhanceService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class EnhanceController extends Controller
+{
+    public function __construct(
+        private readonly EnhanceService $enhanceService,
+    ) {
+    }
+
+    public function index(Request $request): Response
+    {
+        $this->authorize('viewAny', EnhanceJob::class);
+
+        $jobs = EnhanceJob::query()
+            ->where('user_id', (int) $request->user()->id)
+            ->with('artwork:id,title,slug')
+            ->latest('id')
+            ->paginate(12)
+            ->withQueryString()
+            ->through(fn (EnhanceJob $job): array => $this->serializeJobListItem($job));
+
+        $latestCompleted = EnhanceJob::query()
+            ->where('user_id', (int) $request->user()->id)
+            ->where('status', EnhanceJob::STATUS_COMPLETED)
+            ->latest('finished_at')
+            ->limit(4)
+            ->get()
+            ->map(fn (EnhanceJob $job): array => $this->serializeJobListItem($job))
+            ->all();
+
+        return Inertia::render('Enhance/Index', [
+            'title' => 'Skinbase Enhance',
+            'jobs' => $jobs,
+            'latestCompleted' => $latestCompleted,
+            'createUrl' => route('enhance.create'),
+            'indexUrl' => route('enhance.index'),
+            'dailyLimit' => (int) config('enhance.daily_limit', 10),
+            'enhanceConfig' => $this->enhanceService->frontendConfig(),
+        ]);
+    }
+
+    public function create(Request $request): Response
+    {
+        $this->authorize('create', EnhanceJob::class);
+
+        $selectedArtwork = null;
+
+        if (($artworkId = (int) $request->integer('artwork')) > 0) {
+            $artwork = Artwork::query()
+                ->select(['id', 'user_id', 'title', 'slug'])
+                ->findOrFail($artworkId);
+
+            $actor = $request->user();
+            abort_unless($actor !== null, 403);
+
+            $isOwner = (int) $artwork->user_id === (int) $actor->id;
+            $isStaff = $actor->isAdmin() || $actor->isModerator();
+
+            abort_unless($isOwner || $isStaff, 403);
+
+            $selectedArtwork = [
+                'id' => $artwork->id,
+                'title' => $artwork->title,
+                'show_url' => route('art.show', ['id' => $artwork->id, 'slug' => $artwork->slug]),
+                'store_url' => route('artworks.enhance.store', ['artwork' => $artwork->id]),
+            ];
+        }
+
+        return Inertia::render('Enhance/Create', [
+            'title' => 'Skinbase Enhance',
+            'options' => $this->optionsPayload(),
+            'storeUrl' => route('enhance.store'),
+            'indexUrl' => route('enhance.index'),
+            'maxUploadMb' => (int) config('enhance.max_upload_mb', 20),
+            'selectedArtwork' => $selectedArtwork,
+            'enhanceConfig' => $this->enhanceService->frontendConfig(),
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $this->authorize('create', EnhanceJob::class);
+
+        $validated = $request->validate([
+            'image' => ['required', 'file', 'mimetypes:image/jpeg,image/png,image/webp', 'max:' . ((int) config('enhance.max_upload_mb', 20) * 1024)],
+            'scale' => ['required', 'integer', Rule::in((array) config('enhance.allowed_scales', [2, 4]))],
+            'mode' => ['required', 'string', Rule::in((array) config('enhance.allowed_modes', ['standard', 'artwork', 'photo', 'illustration']))],
+        ]);
+
+        $job = $this->enhanceService->createFromUpload($request->user(), $request->file('image'), $validated);
+
+        return redirect()
+            ->route('enhance.show', ['enhanceJob' => $job])
+            ->with('success', 'Enhance job created.');
+    }
+
+    public function show(EnhanceJob $enhanceJob): Response
+    {
+        $this->authorize('view', $enhanceJob);
+        $enhanceJob->loadMissing('artwork:id,title,slug');
+
+        return Inertia::render('Enhance/Show', [
+            'title' => 'Enhance Job',
+            'job' => $this->serializeJobDetail($enhanceJob),
+            'indexUrl' => route('enhance.index'),
+            'createUrl' => route('enhance.create'),
+            'enhanceConfig' => $this->enhanceService->frontendConfig(),
+        ]);
+    }
+
+    public function retry(EnhanceJob $enhanceJob): RedirectResponse
+    {
+        $this->authorize('retry', $enhanceJob);
+
+        $job = $this->enhanceService->retry($enhanceJob);
+
+        return redirect()
+            ->route('enhance.show', ['enhanceJob' => $job])
+            ->with('success', 'Enhance job queued again.');
+    }
+
+    public function destroy(EnhanceJob $enhanceJob): RedirectResponse
+    {
+        $this->authorize('delete', $enhanceJob);
+
+        $this->enhanceService->delete($enhanceJob);
+
+        return redirect()
+            ->route('enhance.index')
+            ->with('success', 'Enhance job deleted.');
+    }
+
+    private function optionsPayload(): array
+    {
+        return [
+            'modes' => array_map(fn (string $mode): array => [
+                'value' => $mode,
+                'label' => ucfirst($mode),
+            ], (array) config('enhance.allowed_modes', [])),
+            'scales' => array_map(fn (int $scale): array => [
+                'value' => $scale,
+                'label' => $scale . 'x',
+            ], array_map('intval', (array) config('enhance.allowed_scales', []))),
+        ];
+    }
+
+    private function serializeJobListItem(EnhanceJob $job): array
+    {
+        return [
+            'id' => $job->id,
+            'status' => (string) $job->status,
+            'engine' => (string) $job->engine,
+            'mode' => (string) $job->mode,
+            'scale' => (int) $job->scale,
+            'source_url' => $job->sourceUrl(),
+            'output_url' => $job->outputUrl(),
+            'preview_url' => $job->previewUrl(),
+            'input_width' => (int) ($job->input_width ?? 0),
+            'input_height' => (int) ($job->input_height ?? 0),
+            'output_width' => (int) ($job->output_width ?? 0),
+            'output_height' => (int) ($job->output_height ?? 0),
+            'error_message' => $job->error_message,
+            'processing_seconds' => $job->processing_seconds,
+            'created_at' => optional($job->created_at)?->toIso8601String(),
+            'finished_at' => optional($job->finished_at)?->toIso8601String(),
+            'show_url' => route('enhance.show', ['enhanceJob' => $job]),
+            'artwork' => $job->artwork ? [
+                'id' => $job->artwork->id,
+                'title' => $job->artwork->title,
+                'slug' => $job->artwork->slug,
+                'url' => route('art.show', ['id' => $job->artwork->id, 'slug' => $job->artwork->slug]),
+            ] : null,
+        ];
+    }
+
+    private function serializeJobDetail(EnhanceJob $job): array
+    {
+        return $this->serializeJobListItem($job) + [
+            'input_filesize' => (int) ($job->input_filesize ?? 0),
+            'input_mime' => $job->input_mime,
+            'output_filesize' => (int) ($job->output_filesize ?? 0),
+            'output_mime' => $job->output_mime,
+            'metadata' => $job->metadata ?? [],
+            'queued_at' => optional($job->queued_at)?->toIso8601String(),
+            'started_at' => optional($job->started_at)?->toIso8601String(),
+            'deleted_at' => optional($job->deleted_at)?->toIso8601String(),
+            'expires_at' => optional($job->expires_at)?->toIso8601String(),
+            'retry_url' => route('enhance.retry', ['enhanceJob' => $job]),
+            'delete_url' => route('enhance.destroy', ['enhanceJob' => $job]),
+            'download_url' => $job->outputUrl(),
+            'can_retry' => auth()->user()?->can('retry', $job) ?? false,
+            'can_delete' => auth()->user()?->can('delete', $job) ?? false,
+        ];
+    }
+}

app/Http/Controllers/GroupController.php

@@ -79,6 +79,7 @@ class GroupController extends Controller
     {
         $this->authorize('view', $group);
 
+        $section = in_array($section, ['overview', 'artworks', 'collections', 'members', 'about', 'posts', 'projects', 'releases', 'challenges', 'events', 'activity'], true) ? $section : 'overview';
         $viewer = $request->user();
         $group->loadMissing('owner.profile');
         $members = collect($this->memberships->mapMembers($group, $viewer))
@@ -89,7 +90,8 @@ class GroupController extends Controller
 
         return Inertia::render('Group/GroupShow', [
             'group' => $groupPayload,
-            'section' => in_array($section, ['overview', 'artworks', 'collections', 'members', 'about', 'posts', 'projects', 'releases', 'challenges', 'events', 'activity'], true) ? $section : 'overview',
+            'section' => $section,
+            'seo' => $this->seoPayload($group, $section),
             'featuredArtworks' => $this->groups->featuredArtworkCards($group),
             'artworks' => $this->groups->publicArtworkCards($group),
             'featuredCollections' => $this->groups->featuredCollectionCards($group, $viewer),
@@ -140,4 +142,19 @@ class GroupController extends Controller
     {
         return $this->show($request, $group, 'activity');
     }
+
+    private function seoPayload(Group $group, string $section): array
+    {
+        $canonical = $section === 'overview'
+            ? route('groups.show', ['group' => $group])
+            : route('groups.section', ['group' => $group, 'section' => $section]);
+        $sectionLabel = $section === 'overview' ? '' : ' '.ucfirst($section);
+
+        return [
+            'title' => trim($group->name.$sectionLabel.' - Skinbase'),
+            'description' => $group->headline ?: $group->bio ?: 'Skinbase group',
+            'canonical' => $canonical,
+            'og_url' => $canonical,
+        ];
+    }
 }

app/Http/Controllers/Internal/EnhanceSourceController.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Internal;
+
+use App\Http\Controllers\Controller;
+use App\Models\EnhanceJob;
+use App\Services\Enhance\EnhanceStorageService;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Throwable;
+
+final class EnhanceSourceController extends Controller
+{
+    public function __construct(
+        private readonly EnhanceStorageService $storage,
+    ) {
+    }
+
+    public function show(Request $request, EnhanceJob $enhanceJob): Response
+    {
+        abort_unless($request->hasValidSignature(), 403);
+        abort_unless($this->storage->isEnhancePath($enhanceJob->source_path), 404);
+
+        try {
+            $binary = $this->storage->fetchSourceBinary($enhanceJob);
+        } catch (Throwable) {
+            abort(404);
+        }
+
+        return response($binary, 200, [
+            'Content-Type' => trim((string) ($enhanceJob->input_mime ?: 'application/octet-stream')),
+            'Content-Length' => (string) strlen($binary),
+            'Cache-Control' => 'private, max-age=60',
+            'Content-Disposition' => 'inline; filename="enhance-source-' . $enhanceJob->id . '"',
+        ]);
+    }
+}

app/Http/Controllers/Legacy/LegacyArtworkPhotoController.php

@@ -8,6 +8,7 @@ use App\Http\Controllers\Controller;
 use App\Models\Artwork;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Response;
 use Illuminate\Support\Facades\Schema;
 
 final class LegacyArtworkPhotoController extends Controller
@@ -26,25 +27,39 @@ final class LegacyArtworkPhotoController extends Controller
 
     private static ?bool $hasLegacyIdColumn = null;
 
-    public function __invoke(string $encoded, string $size, string $extension): RedirectResponse
+    public function __invoke(string $encoded, string $size, string $extension): RedirectResponse|Response
     {
         $artworkId = $this->decodeBase62($encoded);
         $sizeCode = (int) $size;
 
-        abort_if($artworkId === null || $artworkId < 1, 404);
+        if ($artworkId === null || $artworkId < 1) {
+            return $this->notFound();
+        }
 
         $artwork = $this->resolveArtwork($artworkId);
-        abort_unless($artwork !== null, 404);
+        if ($artwork === null) {
+            return $this->notFound();
+        }
 
         $targetUrl = $sizeCode === 7
             ? $this->resolveOriginalUrl($artwork)
             : $artwork->thumbUrl(self::THUMB_SIZE_MAP[$sizeCode] ?? 'md');
 
-        abort_if(empty($targetUrl), 404);
+        if ($targetUrl === null || $targetUrl === '') {
+            return $this->notFound();
+        }
 
         return redirect()->away($targetUrl, 301);
     }
 
+    private function notFound(): Response
+    {
+        return response('', 404, [
+            'Content-Type' => 'text/plain; charset=UTF-8',
+            'Cache-Control' => 'no-store',
+        ]);
+    }
+
     private function decodeBase62(string $value): ?int
     {
         if ($value === '') {
@@ -86,11 +101,6 @@ final class LegacyArtworkPhotoController extends Controller
     {
         $cdn = rtrim((string) config('cdn.files_url', 'https://cdn.skinbase.org'), '/');
         $filePath = trim((string) ($artwork->file_path ?? ''), '/');
-
-        if ($filePath !== '') {
-            return $cdn . '/' . $filePath;
-        }
-
         $hash = strtolower((string) preg_replace('/[^a-f0-9]/i', '', (string) ($artwork->hash ?? '')));
         $ext = ltrim((string) ($artwork->file_ext ?: $artwork->thumb_ext ?: 'webp'), '.');
 
@@ -98,6 +108,10 @@ final class LegacyArtworkPhotoController extends Controller
             return $artwork->thumbUrl('xl') ?? $artwork->thumbUrl('lg') ?? $artwork->thumbUrl('md');
         }
 
+        if ($filePath !== '') {
+            return $cdn . '/' . $filePath;
+        }
+
         $prefix = trim((string) config('uploads.object_storage.prefix', 'artworks'), '/');
         $firstDir = substr($hash, 0, 2);
         $secondDir = substr($hash, 2, 2);

app/Http/Controllers/Legacy/TodayDownloadsController.php

@@ -3,11 +3,12 @@
 namespace App\Http\Controllers\Legacy;
 
 use App\Http\Controllers\Controller;
-use Illuminate\Http\Request;
+use App\Models\Artwork;
 use App\Models\ArtworkDownload;
-use Illuminate\Support\Facades\Storage;
+use App\Services\ThumbnailPresenter;
-use Illuminate\Support\Str;
 use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 
 class TodayDownloadsController extends Controller
 {
@@ -35,16 +36,16 @@ class TodayDownloadsController extends Controller
             $art = $row->artwork ?? null;
             // If Eloquent didn't eager load artwork (group queries sometimes don't), fetch it
             if (! $art && isset($row->artwork_id)) {
-                $art = \App\Models\Artwork::find($row->artwork_id);
+                $art = Artwork::find($row->artwork_id);
             }
 
             $name = $art->title ?? null;
             $picture = $art->file_name ?? null;
             $ext = pathinfo($picture ?? '', PATHINFO_EXTENSION) ?: 'jpg';
             $encoded = null; // legacy encoding unavailable; leave null
-            $present = $art ? \App\Services\ThumbnailPresenter::present($art, 'md') : null;
+            $present = $art ? ThumbnailPresenter::present($art, 'md') : null;
             $thumb = $present ? $present['url'] : 'https://files.skinbase.org/default/missing_md.webp';
-            $categoryId = $art->categories->first()->id ?? null;
+            $categoryId = $art->resolvedPrimaryCategory()?->id;
 
             return (object) [
                 'id' => $art->id ?? null,

app/Http/Controllers/Legacy/UserController.php

@@ -3,12 +3,12 @@
 namespace App\Http\Controllers\Legacy;
 
 use App\Http\Controllers\Controller;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
 use App\Services\AvatarService;
 use Carbon\Carbon;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Schema;
 
 class UserController extends Controller
 {
@@ -37,7 +37,7 @@ class UserController extends Controller
                 }
             } else {
                 // Map legacy form fields into the modern schema.
-                $data = $request->only(['name','web','country_code','signature','description','about_me']);
+                $data = $request->only(['name', 'web', 'country_code', 'signature', 'description', 'about_me']);
 
                 // Core user column: `name`
                 if (isset($data['name'])) {
@@ -46,24 +46,43 @@ class UserController extends Controller
 
                 // Collect other profile updates to persist into `user_profiles` when available
                 $profileUpdates = [];
-                if (!empty($data['web'])) $profileUpdates['website'] = $data['web'];
+                if (! empty($data['web'])) {
-                if (!empty($data['signature'])) $profileUpdates['signature'] = $data['signature'];
+                    $profileUpdates['website'] = $data['web'];
-                if (!empty($data['description'])) $profileUpdates['description'] = $data['description'];
+                }
-                if (!empty($data['about_me'])) $profileUpdates['about'] = $data['about_me'];
+                if (! empty($data['signature'])) {
-                if (!empty($data['country_code'])) $profileUpdates['country_code'] = $data['country_code'];
+                    $profileUpdates['signature'] = $data['signature'];
+                }
+                if (! empty($data['description'])) {
+                    $profileUpdates['description'] = $data['description'];
+                }
+                if (! empty($data['about_me'])) {
+                    $profileUpdates['about'] = $data['about_me'];
+                }
+                if (! empty($data['country_code'])) {
+                    $profileUpdates['country_code'] = $data['country_code'];
+                }
 
                 $d1 = $request->input('date1');
                 $d2 = $request->input('date2');
                 $d3 = $request->input('date3');
                 if ($d1 && $d2 && $d3) {
-                    $profileUpdates['birthdate'] = sprintf('%04d-%02d-%02d', (int)$d3, (int)$d2, (int)$d1);
+                    $profileUpdates['birthdate'] = sprintf('%04d-%02d-%02d', (int) $d3, (int) $d2, (int) $d1);
                 }
 
                 $userGender = $request->input('gender', $user->gender);
-                if (!empty($userGender)) {
+                if ($userGender !== null && $userGender !== '') {
-                    $g = strtolower($userGender);
+                    $g = strtolower(trim((string) $userGender));
-                    $map = ['m' => 'M', 'f' => 'F', 'n' => 'X', 'x' => 'X'];
+                    $map = [
-                    $profileUpdates['gender'] = $map[$g] ?? strtoupper($userGender);
+                        'm' => 'M',
+                        'male' => 'M',
+                        'f' => 'F',
+                        'female' => 'F',
+                        'n' => 'X',
+                        'x' => 'X',
+                        'na' => 'X',
+                        'n/a' => 'X',
+                    ];
+                    $profileUpdates['gender'] = $map[$g] ?? null;
                 }
 
                 $profileUpdates['mlist'] = $request->has('newsletter') ? 1 : 0;
@@ -79,29 +98,37 @@ class UserController extends Controller
                     }
                 }
 
+                $allowedLegacyMimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+
                 if ($request->hasFile('personal_picture')) {
                     $f = $request->file('personal_picture');
-                    $name = $user->id . '.' . $f->getClientOriginalExtension();
+                    if (in_array($f->getMimeType(), $allowedLegacyMimes, true)) {
+                        $ext = $f->guessExtension() ?: 'jpg';
+                        $name = $user->id.'.'.$ext;
                         $f->move(public_path('user-picture'), $name);
                         $profileUpdates['cover_image'] = $name;
                         $user->picture = $name;
                     }
+                }
 
                 if ($request->hasFile('emotion_icon')) {
                     $f = $request->file('emotion_icon');
-                    $name = $user->id . '.' . $f->getClientOriginalExtension();
+                    if (in_array($f->getMimeType(), $allowedLegacyMimes, true)) {
+                        $ext = $f->guessExtension() ?: 'jpg';
+                        $name = $user->id.'.'.$ext;
                         $f->move(public_path('emotion'), $name);
                         $user->eicon = $name;
                     }
+                }
 
                 // Save core user fields
                 $user->save();
 
                 // Persist profile updates into `user_profiles` when available, otherwise fallback to `users` table
                 try {
-                    if (!empty($profileUpdates) && Schema::hasTable('user_profiles')) {
+                    if (! empty($profileUpdates) && Schema::hasTable('user_profiles')) {
                         DB::table('user_profiles')->updateOrInsert(['user_id' => $user->id], $profileUpdates + ['updated_at' => now(), 'created_at' => now()]);
-                    } elseif (!empty($profileUpdates)) {
+                    } elseif (! empty($profileUpdates)) {
                         DB::table('users')->where('id', $user->id)->update($profileUpdates);
                     }
                 } catch (\Throwable $e) {
@@ -135,15 +162,33 @@ class UserController extends Controller
                 $profile = DB::table('user_profiles')->where('user_id', $user->id)->first();
                 if ($profile) {
                     // map modern profile fields onto the legacy user properties/helpers used by the view
-                    if (isset($profile->website)) $user->homepage = $profile->website;
+                    if (isset($profile->website)) {
-                    if (isset($profile->about)) $user->about_me = $profile->about;
+                        $user->homepage = $profile->website;
-                    if (isset($profile->birthdate)) $user->birth = $profile->birthdate;
+                    }
-                    if (isset($profile->gender)) $user->gender = $profile->gender;
+                    if (isset($profile->about)) {
-                    if (isset($profile->country_code)) $user->country_code = $profile->country_code;
+                        $user->about_me = $profile->about;
-                    if (isset($profile->avatar_hash)) $user->icon = $profile->avatar_hash;
+                    }
-                    if (isset($profile->cover_image)) $user->picture = $profile->cover_image;
+                    if (isset($profile->birthdate)) {
-                    if (isset($profile->signature)) $user->signature = $profile->signature;
+                        $user->birth = $profile->birthdate;
-                    if (isset($profile->description)) $user->description = $profile->description;
+                    }
+                    if (isset($profile->gender)) {
+                        $user->gender = $profile->gender;
+                    }
+                    if (isset($profile->country_code)) {
+                        $user->country_code = $profile->country_code;
+                    }
+                    if (isset($profile->avatar_hash)) {
+                        $user->icon = $profile->avatar_hash;
+                    }
+                    if (isset($profile->cover_image)) {
+                        $user->picture = $profile->cover_image;
+                    }
+                    if (isset($profile->signature)) {
+                        $user->signature = $profile->signature;
+                    }
+                    if (isset($profile->description)) {
+                        $user->description = $profile->description;
+                    }
                 }
             }
         } catch (\Throwable $e) {

app/Http/Controllers/Moderation/ModerationEnhanceController.php

@@ -0,0 +1,162 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Moderation;
+
+use App\Http\Controllers\Controller;
+use App\Models\EnhanceJob;
+use App\Services\Enhance\EnhanceService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class ModerationEnhanceController extends Controller
+{
+    public function __construct(
+        private readonly EnhanceService $enhanceService,
+    ) {
+    }
+
+    public function index(Request $request): Response
+    {
+        $filters = [
+            'status' => trim((string) $request->query('status', 'all')),
+            'engine' => trim((string) $request->query('engine', 'all')),
+            'mode' => trim((string) $request->query('mode', 'all')),
+            'scale' => trim((string) $request->query('scale', 'all')),
+            'user' => trim((string) $request->query('user', '')),
+            'date_from' => trim((string) $request->query('date_from', '')),
+            'date_to' => trim((string) $request->query('date_to', '')),
+        ];
+
+        $jobs = EnhanceJob::query()
+            ->with(['user:id,name,username', 'artwork:id,title,slug'])
+            ->when($filters['status'] !== '' && $filters['status'] !== 'all', fn ($query) => $query->where('status', $filters['status']))
+            ->when($filters['engine'] !== '' && $filters['engine'] !== 'all', fn ($query) => $query->where('engine', $filters['engine']))
+            ->when($filters['mode'] !== '' && $filters['mode'] !== 'all', fn ($query) => $query->where('mode', $filters['mode']))
+            ->when($filters['scale'] !== '' && $filters['scale'] !== 'all', fn ($query) => $query->where('scale', (int) $filters['scale']))
+            ->when($filters['user'] !== '', function ($query) use ($filters): void {
+                $query->whereHas('user', function ($userQuery) use ($filters): void {
+                    $userQuery
+                        ->where('name', 'like', '%' . $filters['user'] . '%')
+                        ->orWhere('username', 'like', '%' . $filters['user'] . '%');
+                });
+            })
+            ->when($filters['date_from'] !== '', fn ($query) => $query->whereDate('created_at', '>=', $filters['date_from']))
+            ->when($filters['date_to'] !== '', fn ($query) => $query->whereDate('created_at', '<=', $filters['date_to']))
+            ->latest('id')
+            ->paginate(20)
+            ->withQueryString()
+            ->through(fn (EnhanceJob $job): array => $this->serializeJob($job));
+
+        return Inertia::render('Moderation/Enhance/Index', [
+            'title' => 'Enhance Jobs',
+            'jobs' => $jobs,
+            'filters' => $filters,
+            'options' => [
+                'statuses' => ['all', 'pending', 'queued', 'processing', 'completed', 'failed', 'cancelled', 'expired'],
+                'engines' => ['all', 'stub', 'external_worker'],
+                'modes' => array_merge(['all'], (array) config('enhance.allowed_modes', [])),
+                'scales' => array_merge(['all'], array_map('intval', (array) config('enhance.allowed_scales', []))),
+            ],
+            'indexUrl' => route('admin.enhance.index'),
+            'enhanceConfig' => $this->enhanceService->frontendConfig(),
+        ])->rootView('moderation');
+    }
+
+    public function show(EnhanceJob $enhanceJob): Response
+    {
+        $enhanceJob->loadMissing(['user:id,name,username', 'artwork:id,title,slug']);
+
+        return Inertia::render('Moderation/Enhance/Show', [
+            'title' => 'Enhance Job #' . $enhanceJob->id,
+            'job' => $this->serializeJob($enhanceJob, true),
+            'indexUrl' => route('admin.enhance.index'),
+            'enhanceConfig' => $this->enhanceService->frontendConfig(),
+        ])->rootView('moderation');
+    }
+
+    public function retry(EnhanceJob $enhanceJob): RedirectResponse
+    {
+        $this->authorize('retry', $enhanceJob);
+
+        $job = $this->enhanceService->retry($enhanceJob);
+
+        return redirect()
+            ->route('admin.enhance.show', ['enhanceJob' => $job])
+            ->with('success', 'Enhance job queued again.');
+    }
+
+    public function markFailed(Request $request, EnhanceJob $enhanceJob): RedirectResponse
+    {
+        $this->authorize('markFailed', $enhanceJob);
+
+        $job = $this->enhanceService->markFailedByModerator($enhanceJob, $request->user());
+
+        return redirect()
+            ->route('admin.enhance.show', ['enhanceJob' => $job])
+            ->with('success', 'Enhance job marked as failed.');
+    }
+
+    public function destroy(EnhanceJob $enhanceJob): RedirectResponse
+    {
+        $this->authorize('delete', $enhanceJob);
+
+        $this->enhanceService->delete($enhanceJob);
+
+        return redirect()
+            ->route('admin.enhance.index')
+            ->with('success', 'Enhance job deleted.');
+    }
+
+    private function serializeJob(EnhanceJob $job, bool $detailed = false): array
+    {
+        return [
+            'id' => $job->id,
+            'status' => (string) $job->status,
+            'engine' => (string) $job->engine,
+            'mode' => (string) $job->mode,
+            'scale' => (int) $job->scale,
+            'source_url' => $job->sourceUrl(),
+            'output_url' => $job->outputUrl(),
+            'preview_url' => $job->previewUrl(),
+            'input_width' => (int) ($job->input_width ?? 0),
+            'input_height' => (int) ($job->input_height ?? 0),
+            'input_filesize' => (int) ($job->input_filesize ?? 0),
+            'input_mime' => $job->input_mime,
+            'output_width' => (int) ($job->output_width ?? 0),
+            'output_height' => (int) ($job->output_height ?? 0),
+            'output_filesize' => (int) ($job->output_filesize ?? 0),
+            'output_mime' => $job->output_mime,
+            'processing_seconds' => $job->processing_seconds,
+            'error_message' => $job->error_message,
+            'metadata' => $job->metadata ?? [],
+            'created_at' => optional($job->created_at)?->toIso8601String(),
+            'queued_at' => optional($job->queued_at)?->toIso8601String(),
+            'started_at' => optional($job->started_at)?->toIso8601String(),
+            'finished_at' => optional($job->finished_at)?->toIso8601String(),
+            'expires_at' => optional($job->expires_at)?->toIso8601String(),
+            'user' => $job->user ? [
+                'id' => $job->user->id,
+                'name' => $job->user->name,
+                'username' => $job->user->username,
+            ] : null,
+            'artwork' => $job->artwork ? [
+                'id' => $job->artwork->id,
+                'title' => $job->artwork->title,
+                'slug' => $job->artwork->slug,
+                'url' => route('art.show', ['id' => $job->artwork->id, 'slug' => $job->artwork->slug]),
+            ] : null,
+            'show_url' => route('admin.enhance.show', ['enhanceJob' => $job]),
+            'download_url' => $job->outputUrl(),
+            'retry_url' => route('admin.enhance.retry', ['enhanceJob' => $job]),
+            'mark_failed_url' => route('admin.enhance.mark-failed', ['enhanceJob' => $job]),
+            'delete_url' => route('admin.enhance.destroy', ['enhanceJob' => $job]),
+            'can_retry' => $job->status === EnhanceJob::STATUS_FAILED,
+            'can_mark_failed' => in_array($job->status, [EnhanceJob::STATUS_PENDING, EnhanceJob::STATUS_QUEUED, EnhanceJob::STATUS_PROCESSING], true),
+            'detailed' => $detailed,
+        ];
+    }
+}

app/Http/Controllers/Moderation/StaffApplicationsController.php

@@ -0,0 +1,98 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Moderation;
+
+use App\Http\Controllers\Controller;
+use App\Models\StaffApplication;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class StaffApplicationsController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $filters = [
+            'q' => trim((string) $request->query('q', '')),
+            'topic' => trim((string) $request->query('topic', 'all')),
+        ];
+
+        $query = StaffApplication::query()->latest('created_at');
+
+        if ($filters['q'] !== '') {
+            $search = $filters['q'];
+            $query->where(function ($builder) use ($search): void {
+                $builder
+                    ->where('name', 'like', '%' . $search . '%')
+                    ->orWhere('email', 'like', '%' . $search . '%')
+                    ->orWhere('role', 'like', '%' . $search . '%')
+                    ->orWhere('message', 'like', '%' . $search . '%');
+            });
+        }
+
+        if ($filters['topic'] !== '' && $filters['topic'] !== 'all') {
+            $query->where('topic', $filters['topic']);
+        }
+
+        $items = $query
+            ->paginate(20)
+            ->withQueryString()
+            ->through(fn (StaffApplication $application): array => $this->serializeApplication($application));
+
+        $stats = [
+            'total' => StaffApplication::query()->count(),
+            'applications' => StaffApplication::query()->where('topic', 'application')->count(),
+            'bug' => StaffApplication::query()->where('topic', 'bug')->count(),
+            'contact' => StaffApplication::query()->where('topic', 'contact')->count(),
+            'other' => StaffApplication::query()->whereNotIn('topic', ['application', 'bug', 'contact'])->count(),
+        ];
+
+        $topics = StaffApplication::query()
+            ->select('topic')
+            ->distinct()
+            ->orderBy('topic')
+            ->pluck('topic')
+            ->values()
+            ->all();
+
+        return Inertia::render('Moderation/StaffApplications/Index', [
+            'title' => 'Staff Applications',
+            'items' => $items,
+            'filters' => $filters,
+            'stats' => $stats,
+            'topics' => $topics,
+            'endpoints' => [
+                'index' => route('admin.staff-applications.index'),
+            ],
+        ])->rootView('moderation');
+    }
+
+    public function show(StaffApplication $staffApplication): Response
+    {
+        return Inertia::render('Moderation/StaffApplications/Show', [
+            'title' => 'Staff Application',
+            'item' => $this->serializeApplication($staffApplication, true),
+            'backUrl' => route('admin.staff-applications.index'),
+        ])->rootView('moderation');
+    }
+
+    private function serializeApplication(StaffApplication $application, bool $detailed = false): array
+    {
+        return [
+            'id' => (string) $application->id,
+            'topic' => (string) ($application->topic ?: 'contact'),
+            'name' => (string) ($application->name ?: 'Unknown'),
+            'email' => (string) ($application->email ?: ''),
+            'role' => $application->role,
+            'portfolio' => $application->portfolio,
+            'message' => $application->message,
+            'ip' => $application->ip,
+            'user_agent' => $application->user_agent,
+            'created_at' => optional($application->created_at)?->toIso8601String(),
+            'payload' => $detailed ? ($application->payload ?? []) : [],
+            'show_url' => route('admin.staff-applications.show', ['staffApplication' => $application]),
+        ];
+    }
+}

app/Http/Controllers/Moderation/StoriesController.php

@@ -0,0 +1,105 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Moderation;
+
+use App\Http\Controllers\Controller;
+use App\Models\Story;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class StoriesController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $filters = [
+            'q' => trim((string) $request->query('q', '')),
+            'status' => trim((string) $request->query('status', 'all')),
+        ];
+
+        $query = Story::query()
+            ->with('creator:id,name,username')
+            ->latest('created_at')
+            ->latest('id');
+
+        if ($filters['q'] !== '') {
+            $search = $filters['q'];
+            $query->where(function ($builder) use ($search): void {
+                $builder
+                    ->where('title', 'like', '%' . $search . '%')
+                    ->orWhere('slug', 'like', '%' . $search . '%')
+                    ->orWhereHas('creator', function ($creatorQuery) use ($search): void {
+                        $creatorQuery
+                            ->where('name', 'like', '%' . $search . '%')
+                            ->orWhere('username', 'like', '%' . $search . '%');
+                    });
+            });
+        }
+
+        if ($filters['status'] !== '' && $filters['status'] !== 'all') {
+            $query->where('status', $filters['status']);
+        }
+
+        $stories = $query
+            ->paginate(24)
+            ->withQueryString()
+            ->through(fn (Story $story): array => $this->serializeStory($story));
+
+        $statsQuery = Story::query();
+        if ($filters['q'] !== '') {
+            $search = $filters['q'];
+            $statsQuery->where(function ($builder) use ($search): void {
+                $builder
+                    ->where('title', 'like', '%' . $search . '%')
+                    ->orWhere('slug', 'like', '%' . $search . '%')
+                    ->orWhereHas('creator', function ($creatorQuery) use ($search): void {
+                        $creatorQuery
+                            ->where('name', 'like', '%' . $search . '%')
+                            ->orWhere('username', 'like', '%' . $search . '%');
+                    });
+            });
+        }
+
+        $stats = [
+            'total' => (clone $statsQuery)->count(),
+            'published' => (clone $statsQuery)->where('status', 'published')->count(),
+            'draft' => (clone $statsQuery)->where('status', 'draft')->count(),
+            'scheduled' => (clone $statsQuery)->where('status', 'scheduled')->count(),
+            'pending_review' => (clone $statsQuery)->where('status', 'pending_review')->count(),
+            'archived' => (clone $statsQuery)->where('status', 'archived')->count(),
+        ];
+
+        return Inertia::render('Moderation/Stories', [
+            'title' => 'Stories',
+            'stories' => $stories,
+            'filters' => $filters,
+            'stats' => $stats,
+            'endpoints' => [
+                'index' => route('admin.stories'),
+            ],
+        ])->rootView('moderation');
+    }
+
+    private function serializeStory(Story $story): array
+    {
+        return [
+            'id' => (int) $story->id,
+            'title' => (string) ($story->title ?: 'Untitled story'),
+            'slug' => (string) $story->slug,
+            'excerpt' => $story->excerpt,
+            'status' => (string) ($story->status ?: 'draft'),
+            'published_at' => optional($story->published_at)?->toIso8601String(),
+            'created_at' => optional($story->created_at)?->toIso8601String(),
+            'cover_url' => $story->coverUrl,
+            'public_url' => $story->url,
+            'open_url' => $story->status === 'published' ? $story->url : null,
+            'creator' => $story->creator ? [
+                'id' => (int) $story->creator->id,
+                'name' => (string) $story->creator->name,
+                'username' => (string) $story->creator->username,
+            ] : null,
+        ];
+    }
+}

app/Http/Controllers/Moderation/UsernameQueueController.php

@@ -0,0 +1,116 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Moderation;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class UsernameQueueController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        $filters = [
+            'q' => trim((string) $request->query('q', '')),
+            'status' => trim((string) $request->query('status', 'pending')),
+        ];
+
+        $requestColumns = Schema::hasTable('username_approval_requests')
+            ? Schema::getColumnListing('username_approval_requests')
+            : [];
+
+        $query = DB::table('username_approval_requests as requests')
+            ->leftJoin('users', 'users.id', '=', 'requests.user_id')
+            ->select([
+                'requests.id',
+                'requests.user_id',
+                'requests.requested_username',
+                'requests.status',
+                'requests.context',
+                'requests.similar_to',
+                'requests.review_note',
+                'requests.reviewed_at',
+                'requests.created_at',
+                'users.username as current_username',
+                'users.name as current_name',
+            ])
+            ->orderByDesc('requests.created_at');
+
+        if ($filters['status'] !== '' && $filters['status'] !== 'all') {
+            $query->where('requests.status', $filters['status']);
+        }
+
+        if ($filters['q'] !== '') {
+            $search = $filters['q'];
+            $query->where(function ($builder) use ($search): void {
+                $builder
+                    ->where('requests.requested_username', 'like', '%' . $search . '%')
+                    ->orWhere('requests.context', 'like', '%' . $search . '%')
+                    ->orWhere('users.username', 'like', '%' . $search . '%')
+                    ->orWhere('users.name', 'like', '%' . $search . '%');
+            });
+        }
+
+        $requests = $query->paginate(20)->withQueryString()->through(function ($row): array {
+            return [
+                'id' => (int) $row->id,
+                'user_id' => $row->user_id !== null ? (int) $row->user_id : null,
+                'requested_username' => (string) $row->requested_username,
+                'status' => (string) ($row->status ?? 'pending'),
+                'context' => $row->context ?? null,
+                'similar_to' => $row->similar_to ?? null,
+                'review_note' => $row->review_note ?? null,
+                'reviewed_at' => $this->serializeTimestamp($row->reviewed_at ?? null),
+                'created_at' => $this->serializeTimestamp($row->created_at ?? null),
+                'current_username' => $row->current_username,
+                'current_name' => $row->current_name,
+                'approve_url' => route('api.admin.usernames.approve', ['id' => $row->id]),
+                'reject_url' => route('api.admin.usernames.reject', ['id' => $row->id]),
+            ];
+        });
+
+        $stats = [
+            'total' => Schema::hasTable('username_approval_requests') ? DB::table('username_approval_requests')->count() : 0,
+            'pending' => Schema::hasTable('username_approval_requests') ? DB::table('username_approval_requests')->where('status', 'pending')->count() : 0,
+            'approved' => Schema::hasTable('username_approval_requests') ? DB::table('username_approval_requests')->where('status', 'approved')->count() : 0,
+            'rejected' => Schema::hasTable('username_approval_requests') ? DB::table('username_approval_requests')->where('status', 'rejected')->count() : 0,
+        ];
+
+        return Inertia::render('Moderation/UsernameQueue', [
+            'title' => 'Username Queue',
+            'requests' => $requests,
+            'stats' => $stats,
+            'filters' => $filters,
+            'options' => [
+                'statuses' => [
+                    ['value' => 'all', 'label' => 'All statuses'],
+                    ['value' => 'pending', 'label' => 'Pending'],
+                    ['value' => 'approved', 'label' => 'Approved'],
+                    ['value' => 'rejected', 'label' => 'Rejected'],
+                ],
+            ],
+            'endpoints' => [
+                'index' => route('admin.usernames'),
+                'refresh' => route('admin.usernames'),
+            ],
+        ])->rootView('moderation');
+    }
+
+    private function serializeTimestamp(mixed $value): ?string
+    {
+        if ($value === null || $value === '') {
+            return null;
+        }
+
+        try {
+            return \Illuminate\Support\Carbon::parse((string) $value)->toIso8601String();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+}

app/Http/Controllers/News/NewsController.php

@@ -132,6 +132,32 @@ class NewsController extends Controller
         ] + $this->sidebarData());
     }
 
+    // -----------------------------------------------------------------------
+    // Type page — /news/type/{type}
+    // -----------------------------------------------------------------------
+
+    public function type(Request $request, string $type): View
+    {
+        $typeLabels = \cPad\Plugins\News\Models\NewsArticle::TYPE_LABELS;
+
+        abort_unless(array_key_exists($type, $typeLabels), 404);
+
+        $label   = $typeLabels[$type];
+        $perPage = config('news.articles_per_page', 12);
+
+        $articles = NewsArticle::with('author', 'category')
+            ->published()
+            ->where('type', $type)
+            ->editorialOrder()
+            ->paginate($perPage);
+
+        return view('news.type', [
+            'type'      => $type,
+            'typeLabel' => $label,
+            'articles'  => $articles,
+        ] + $this->sidebarData());
+    }
+
     // -----------------------------------------------------------------------
     // Article page — /news/{slug}
     // -----------------------------------------------------------------------
@@ -173,6 +199,7 @@ class NewsController extends Controller
             return;
         }
 
+        try {
             NewsView::create([
                 'article_id' => $article->id,
                 'user_id'    => $userId,
@@ -181,6 +208,12 @@ class NewsController extends Controller
             ]);
 
             $article->incrementViews();
+        } catch (\Illuminate\Database\QueryException $e) {
+            // Unique constraint violation — duplicate view, skip silently.
+            if (($e->errorInfo[1] ?? 0) !== 1062) {
+                throw $e;
+            }
+        }
 
         if ($canReadSession) {
             $request->session()->put($session, true);

app/Http/Controllers/News/NewsRssController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\News;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Response;
+use Illuminate\Support\Facades\Cache;
 use cPad\Plugins\News\Models\NewsArticle;
 
 class NewsRssController extends Controller
@@ -14,13 +15,17 @@ class NewsRssController extends Controller
      */
     public function feed(): Response
     {
+        $ttl = max(60, (int) config('news.rss_cache_ttl', 300));
+
+        $xml = Cache::remember('news.rss.feed', $ttl, function (): string {
             $articles = NewsArticle::with('author', 'category')
                 ->published()
                 ->orderByDesc('published_at')
                 ->limit(config('news.rss_limit', 25))
                 ->get();
 
-        $xml = $this->buildRss($articles);
+            return $this->buildRss($articles);
+        });
 
         return response($xml, 200, [
             'Content-Type' => 'application/rss+xml; charset=UTF-8',

app/Http/Controllers/Settings/AcademyAdminAnalyticsController.php

@@ -0,0 +1,628 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Settings;
+
+use App\Http\Controllers\Controller;
+use App\Models\AcademyContentMetricDaily;
+use App\Models\AcademyEvent;
+use App\Models\AcademySearchLog;
+use App\Services\Academy\AcademyAnalyticsContentResolver;
+use App\Services\Academy\AcademyContentIntelligenceService;
+use App\Services\Academy\AcademyPopularityService;
+use App\Support\AcademyAnalytics\AcademyAnalyticsContentType;
+use App\Support\AcademyAnalytics\AcademyAnalyticsEventType;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class AcademyAdminAnalyticsController extends Controller
+{
+    public function __construct(
+        private readonly AcademyPopularityService $popularity,
+        private readonly AcademyAnalyticsContentResolver $resolver,
+        private readonly AcademyContentIntelligenceService $intelligence,
+    ) {}
+
+    public function overview(Request $request): Response
+    {
+        [$from, $to, $range] = $this->resolveDateRange($request);
+        $promptLibraryCurrent = $this->contentSummary(AcademyAnalyticsContentType::PROMPT_LIBRARY, $from, $to);
+        [$previousFrom, $previousTo] = $this->previousRange($from, $to);
+        $promptLibraryPrevious = $this->contentSummary(AcademyAnalyticsContentType::PROMPT_LIBRARY, $previousFrom, $previousTo);
+
+        $summary = $this->metricsQuery($from, $to)
+            ->selectRaw('sum(views) as views, sum(unique_visitors) as unique_visitors, sum(user_views) as user_views, sum(guest_views) as guest_views, sum(subscriber_views) as subscriber_views, sum(prompt_copies) as prompt_copies, sum(likes) as likes, sum(saves) as saves, sum(completions) as completions, sum(starts) as starts, sum(upgrade_clicks) as upgrade_clicks')
+            ->first();
+
+        return Inertia::render('Admin/Academy/AnalyticsOverview', [
+            'nav' => $this->nav(),
+            'range' => $this->rangePayload($range, $from, $to),
+            'stats' => [
+                'views' => (int) ($summary?->views ?? 0),
+                'uniqueVisitors' => (int) ($summary?->unique_visitors ?? 0),
+                'userViews' => (int) ($summary?->user_views ?? 0),
+                'guestViews' => (int) ($summary?->guest_views ?? 0),
+                'subscriberViews' => (int) ($summary?->subscriber_views ?? 0),
+                'promptCopies' => (int) ($summary?->prompt_copies ?? 0),
+                'likes' => (int) ($summary?->likes ?? 0),
+                'saves' => (int) ($summary?->saves ?? 0),
+                'lessonCompletions' => (int) ($summary?->completions ?? 0),
+                'courseStarts' => (int) ($summary?->starts ?? 0),
+                'upgradeClicks' => (int) ($summary?->upgrade_clicks ?? 0),
+            ],
+            'promptLibraryTrend' => [
+                'current' => $promptLibraryCurrent,
+                'previous' => $promptLibraryPrevious,
+                'deltas' => [
+                    'views' => $this->percentDelta((int) $promptLibraryCurrent['views'], (int) $promptLibraryPrevious['views']),
+                    'uniqueVisitors' => $this->percentDelta((int) $promptLibraryCurrent['uniqueVisitors'], (int) $promptLibraryPrevious['uniqueVisitors']),
+                    'engagedViews' => $this->percentDelta((int) $promptLibraryCurrent['engagedViews'], (int) $promptLibraryPrevious['engagedViews']),
+                    'engagementRate' => $this->percentDelta((float) $promptLibraryCurrent['engagementRate'], (float) $promptLibraryPrevious['engagementRate']),
+                ],
+                'range' => [
+                    'current' => ['from' => $from->toDateString(), 'to' => $to->toDateString()],
+                    'previous' => ['from' => $previousFrom->toDateString(), 'to' => $previousTo->toDateString()],
+                ],
+            ],
+            'popularPromptPeriodUsage' => $this->popularPromptPeriodUsage($from, $to),
+            'topContent' => $this->serializeContentRows($this->popularity->topContent($from, $to, 8)),
+            'topWeek' => $this->serializeContentRows($this->popularity->topContent(now()->subDays(6)->startOfDay(), now()->endOfDay(), 8)),
+        ]);
+    }
+
+    public function content(Request $request): Response
+    {
+        return $this->renderContentPage($request, null, 'Content performance', 'Cross-module performance across prompts, lessons, courses, packs, and challenges.');
+    }
+
+    public function prompts(Request $request): Response
+    {
+        return $this->renderContentPage($request, AcademyAnalyticsContentType::PROMPT, 'Prompt analytics', 'Copy-heavy prompt performance, save rates, and upgrade interest.');
+    }
+
+    public function promptLibrary(Request $request): Response
+    {
+        return $this->renderContentPage($request, AcademyAnalyticsContentType::PROMPT_LIBRARY, 'Prompt library analytics', 'Discovery and engagement on the public /academy/prompts library page.');
+    }
+
+    public function lessons(Request $request): Response
+    {
+        return $this->renderContentPage($request, AcademyAnalyticsContentType::LESSON, 'Lesson analytics', 'Lesson engagement, starts, completions, and drop-off signals.');
+    }
+
+    public function courses(Request $request): Response
+    {
+        return $this->renderContentPage($request, AcademyAnalyticsContentType::COURSE, 'Course analytics', 'Course views, starts, completion progress, and upgrade intent.');
+    }
+
+    public function search(Request $request): Response
+    {
+        [$from, $to, $range] = $this->resolveDateRange($request);
+
+        $searchQuery = AcademySearchLog::query()->whereBetween('created_at', [$from, $to]);
+        $searchLogs = (clone $searchQuery)->latest('created_at')->limit(500)->get();
+
+        return Inertia::render('Admin/Academy/AnalyticsSearch', [
+            'nav' => $this->nav(),
+            'range' => $this->rangePayload($range, $from, $to),
+            'summary' => [
+                'searches' => (int) (clone $searchQuery)->count(),
+                'zeroResultSearches' => (int) (clone $searchQuery)->where('results_count', 0)->count(),
+                'loggedInSearches' => (int) (clone $searchQuery)->where('is_logged_in', true)->count(),
+                'subscriberSearches' => (int) (clone $searchQuery)->where('is_subscriber', true)->count(),
+                'searchesWithClicks' => (int) (clone $searchQuery)->whereNotNull('clicked_content_id')->count(),
+            ],
+            'topSearches' => (clone $searchQuery)
+                ->selectRaw('normalized_query, max(query) as query, count(*) as searches, sum(results_count = 0) as zero_result_hits, avg(results_count) as avg_results, sum(case when clicked_content_id is not null then 1 else 0 end) as clicks')
+                ->groupBy('normalized_query')
+                ->orderByDesc('searches')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'query' => (string) ($row->query ?: $row->normalized_query),
+                    'normalized_query' => (string) $row->normalized_query,
+                    'searches' => (int) $row->searches,
+                    'zero_result_hits' => (int) $row->zero_result_hits,
+                    'avg_results' => round((float) $row->avg_results, 1),
+                    'clicks' => (int) ($row->clicks ?? 0),
+                    'click_through_rate' => (int) $row->searches > 0 ? round((((int) ($row->clicks ?? 0)) / (int) $row->searches) * 100, 1) : 0,
+                ])
+                ->all(),
+            'zeroResults' => (clone $searchQuery)
+                ->selectRaw('normalized_query, max(query) as query, count(*) as searches')
+                ->where('results_count', 0)
+                ->groupBy('normalized_query')
+                ->orderByDesc('searches')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'query' => (string) ($row->query ?: $row->normalized_query),
+                    'searches' => (int) $row->searches,
+                ])
+                ->all(),
+            'lowClickThroughSearches' => (clone $searchQuery)
+                ->selectRaw('normalized_query, max(query) as query, count(*) as searches, sum(case when clicked_content_id is not null then 1 else 0 end) as clicks, avg(results_count) as avg_results')
+                ->groupBy('normalized_query')
+                ->havingRaw('count(*) >= 2')
+                ->orderByRaw('case when count(*) = 0 then 1 else (sum(case when clicked_content_id is not null then 1 else 0 end) * 1.0 / count(*)) end asc')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'query' => (string) ($row->query ?: $row->normalized_query),
+                    'searches' => (int) $row->searches,
+                    'clicks' => (int) ($row->clicks ?? 0),
+                    'avg_results' => round((float) $row->avg_results, 1),
+                    'click_through_rate' => (int) $row->searches > 0 ? round((((int) ($row->clicks ?? 0)) / (int) $row->searches) * 100, 1) : 0,
+                ])
+                ->all(),
+            'highestClickThroughSearches' => (clone $searchQuery)
+                ->selectRaw('normalized_query, max(query) as query, count(*) as searches, sum(case when clicked_content_id is not null then 1 else 0 end) as clicks, avg(results_count) as avg_results')
+                ->groupBy('normalized_query')
+                ->havingRaw('count(*) >= 2')
+                ->orderByRaw('(sum(case when clicked_content_id is not null then 1 else 0 end) * 1.0 / count(*)) desc')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'query' => (string) ($row->query ?: $row->normalized_query),
+                    'searches' => (int) $row->searches,
+                    'clicks' => (int) ($row->clicks ?? 0),
+                    'avg_results' => round((float) $row->avg_results, 1),
+                    'click_through_rate' => (int) $row->searches > 0 ? round((((int) ($row->clicks ?? 0)) / (int) $row->searches) * 100, 1) : 0,
+                ])
+                ->all(),
+            'searchesWithResultsNoClicks' => (clone $searchQuery)
+                ->selectRaw('normalized_query, max(query) as query, count(*) as searches, avg(results_count) as avg_results')
+                ->where('results_count', '>', 0)
+                ->whereNull('clicked_content_id')
+                ->groupBy('normalized_query')
+                ->orderByDesc('searches')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'query' => (string) ($row->query ?: $row->normalized_query),
+                    'searches' => (int) $row->searches,
+                    'avg_results' => round((float) $row->avg_results, 1),
+                    'clicks' => 0,
+                    'click_through_rate' => 0,
+                ])
+                ->all(),
+            'topClickedResults' => (clone $searchQuery)
+                ->selectRaw('clicked_content_type, clicked_content_id, count(*) as clicks')
+                ->whereNotNull('clicked_content_type')
+                ->whereNotNull('clicked_content_id')
+                ->groupBy('clicked_content_type', 'clicked_content_id')
+                ->orderByDesc('clicks')
+                ->limit(20)
+                ->get()
+                ->map(fn ($row): array => [
+                    'title' => $this->resolver->title((string) $row->clicked_content_type, (int) $row->clicked_content_id),
+                    'content_type' => (string) $row->clicked_content_type,
+                    'content_id' => (int) $row->clicked_content_id,
+                    'clicks' => (int) $row->clicks,
+                ])
+                ->all(),
+            'filterUsage' => $this->summarizeSearchFilters($searchLogs),
+            'recentSearches' => (clone $searchQuery)
+                ->latest('created_at')
+                ->limit(25)
+                ->get()
+                ->map(fn (AcademySearchLog $log): array => [
+                    'query' => (string) $log->query,
+                    'results_count' => (int) $log->results_count,
+                    'logged_in' => (bool) $log->is_logged_in,
+                    'subscriber' => (bool) $log->is_subscriber,
+                    'clicked_content_type' => $log->clicked_content_type,
+                    'has_click' => $log->clicked_content_id !== null,
+                    'created_at' => $log->created_at?->toISOString(),
+                ])
+                ->all(),
+        ]);
+    }
+
+    public function intelligence(Request $request): Response
+    {
+        [$from, $to, $range] = $this->resolveDateRange($request, '30d');
+        $filters = [
+            'from' => $from,
+            'to' => $to,
+            'limit' => 25,
+        ];
+
+        return Inertia::render('Admin/Academy/AnalyticsIntelligence', [
+            'nav' => $this->nav(),
+            'range' => $this->rangePayload($range, $from, $to),
+            'contentOpportunities' => $this->intelligence->getContentOpportunities($filters),
+            'searchGaps' => $this->intelligence->getSearchGaps($filters),
+            'promptInsights' => $this->intelligence->getPromptInsights($filters),
+            'lessonDropoffs' => $this->intelligence->getLessonDropoffs($filters),
+            'courseHealth' => $this->intelligence->getCourseHealth($filters),
+            'premiumInterest' => $this->intelligence->getPremiumInterest($filters),
+            'editorialRecommendations' => $this->intelligence->getEditorialRecommendations($filters),
+        ]);
+    }
+
+    /**
+     * @param  Collection<int, AcademySearchLog>  $logs
+     * @return list<array<string, int|string>>
+     */
+    private function summarizeSearchFilters(Collection $logs): array
+    {
+        $counts = [];
+
+        foreach ($logs as $log) {
+            $filters = is_array($log->filters) ? $log->filters : [];
+
+            foreach ($filters as $key => $value) {
+                if ($value === null || $value === '' || $key === 'q') {
+                    continue;
+                }
+
+                $values = is_array($value) ? $value : [$value];
+
+                foreach ($values as $rawValue) {
+                    $label = trim((string) $rawValue);
+                    if ($label === '') {
+                        continue;
+                    }
+
+                    $bucket = sprintf('%s:%s', $key, $label);
+                    $counts[$bucket] = [
+                        'filter' => (string) $key,
+                        'value' => $label,
+                        'uses' => (int) (($counts[$bucket]['uses'] ?? 0) + 1),
+                    ];
+                }
+            }
+        }
+
+        usort($counts, static fn (array $left, array $right): int => $right['uses'] <=> $left['uses']);
+
+        return array_slice(array_values($counts), 0, 20);
+    }
+
+    public function funnel(Request $request): Response
+    {
+        [$from, $to, $range] = $this->resolveDateRange($request);
+
+        $summary = $this->metricsQuery($from, $to)
+            ->selectRaw('sum(unique_visitors) as unique_visitors, sum(premium_preview_views) as premium_preview_views, sum(upgrade_clicks) as upgrade_clicks, sum(starts) as starts, sum(completions) as completions')
+            ->first();
+
+        $bestConverters = $this->metricsQuery($from, $to)
+            ->selectRaw('content_type, content_id, sum(unique_visitors) as unique_visitors, sum(premium_preview_views) as premium_preview_views, sum(upgrade_clicks) as upgrade_clicks, sum(conversion_score) as conversion_score')
+            ->groupBy('content_type', 'content_id')
+            ->havingRaw('sum(upgrade_clicks) > 0')
+            ->orderByDesc('conversion_score')
+            ->limit(12)
+            ->get();
+
+        return Inertia::render('Admin/Academy/AnalyticsFunnel', [
+            'nav' => $this->nav(),
+            'range' => $this->rangePayload($range, $from, $to),
+            'summary' => [
+                'academyVisitors' => (int) ($summary?->unique_visitors ?? 0),
+                'premiumPreviewViews' => (int) ($summary?->premium_preview_views ?? 0),
+                'upgradeClicks' => (int) ($summary?->upgrade_clicks ?? 0),
+                'starts' => (int) ($summary?->starts ?? 0),
+                'completions' => (int) ($summary?->completions ?? 0),
+                'checkoutStarts' => 0,
+                'subscriptions' => 0,
+            ],
+            'bestConverters' => $this->serializeContentRows($bestConverters, includeConversion: true),
+        ]);
+    }
+
+    private function renderContentPage(Request $request, ?string $forcedContentType, string $title, string $subtitle): Response
+    {
+        [$from, $to, $range] = $this->resolveDateRange($request);
+        $sort = (string) $request->query('sort', 'popularity_score');
+        $direction = strtolower((string) $request->query('direction', 'desc')) === 'asc' ? 'asc' : 'desc';
+        $access = trim((string) $request->query('access', ''));
+        $contentType = $forcedContentType ?: (trim((string) $request->query('content_type', '')) ?: null);
+
+        $query = $this->metricsQuery($from, $to)
+            ->selectRaw('content_type, content_id, sum(views) as views, sum(unique_visitors) as unique_visitors, sum(engaged_views) as engaged_views, sum(likes) as likes, sum(saves) as saves, sum(prompt_copies) as prompt_copies, sum(starts) as starts, sum(completions) as completions, sum(upgrade_clicks) as upgrade_clicks, sum(popularity_score) as popularity_score, sum(conversion_score) as conversion_score')
+            ->groupBy('content_type', 'content_id');
+
+        if ($contentType !== null) {
+            $query->where('content_type', $contentType);
+        }
+
+        $rows = $query->get();
+
+        $serializedRows = $this->serializeContentRows($rows, includeConversion: true)
+            ->filter(function (array $row) use ($access): bool {
+                if ($access === '') {
+                    return true;
+                }
+
+                return strtolower((string) ($row['access_level'] ?? '')) === strtolower($access);
+            })
+            ->sortBy($sort, SORT_REGULAR, $direction === 'desc')
+            ->values()
+            ->all();
+
+        return Inertia::render('Admin/Academy/AnalyticsContent', [
+            'nav' => $this->nav(),
+            'range' => $this->rangePayload($range, $from, $to),
+            'title' => $title,
+            'subtitle' => $subtitle,
+            'filters' => [
+                'sort' => $sort,
+                'direction' => $direction,
+                'access' => $access,
+                'content_type' => $contentType,
+            ],
+            'summary' => $contentType === AcademyAnalyticsContentType::PROMPT_LIBRARY
+                ? $this->contentSummary(AcademyAnalyticsContentType::PROMPT_LIBRARY, $from, $to)
+                : null,
+            'rows' => $serializedRows,
+            'contentTypeOptions' => [
+                ['value' => '', 'label' => 'All content'],
+                ['value' => AcademyAnalyticsContentType::PROMPT_LIBRARY, 'label' => 'Prompt library'],
+                ['value' => AcademyAnalyticsContentType::PROMPT_PACK_LIBRARY, 'label' => 'Prompt pack library'],
+                ['value' => AcademyAnalyticsContentType::PROMPT, 'label' => 'Prompts'],
+                ['value' => AcademyAnalyticsContentType::LESSON, 'label' => 'Lessons'],
+                ['value' => AcademyAnalyticsContentType::COURSE, 'label' => 'Courses'],
+                ['value' => AcademyAnalyticsContentType::PROMPT_PACK, 'label' => 'Prompt packs'],
+                ['value' => AcademyAnalyticsContentType::CHALLENGE, 'label' => 'Challenges'],
+            ],
+            'sortOptions' => [
+                ['value' => 'views', 'label' => 'Views'],
+                ['value' => 'unique_visitors', 'label' => 'Unique visitors'],
+                ['value' => 'likes', 'label' => 'Likes'],
+                ['value' => 'saves', 'label' => 'Saves'],
+                ['value' => 'prompt_copies', 'label' => 'Copies'],
+                ['value' => 'completions', 'label' => 'Completions'],
+                ['value' => 'upgrade_clicks', 'label' => 'Upgrade clicks'],
+                ['value' => 'popularity_score', 'label' => 'Popularity score'],
+                ['value' => 'conversion_score', 'label' => 'Conversion score'],
+            ],
+        ]);
+    }
+
+    private function metricsQuery(Carbon $from, Carbon $to)
+    {
+        return AcademyContentMetricDaily::query()
+            ->whereBetween('date', [$from->copy()->startOfDay(), $to->copy()->endOfDay()]);
+    }
+
+    /**
+     * @return array<string, int|float>
+     */
+    private function contentSummary(string $contentType, Carbon $from, Carbon $to): array
+    {
+        $query = $this->metricsQuery($from, $to)
+            ->where('content_type', $contentType);
+
+        if (! AcademyAnalyticsContentType::requiresContentId($contentType)) {
+            $query->whereNull('content_id');
+        }
+
+        $summary = $query
+            ->selectRaw('sum(views) as views, sum(unique_visitors) as unique_visitors, sum(engaged_views) as engaged_views, sum(scroll_50) as scroll_50, sum(scroll_75) as scroll_75, sum(scroll_100) as scroll_100, avg(avg_engaged_seconds) as avg_engaged_seconds, sum(popularity_score) as popularity_score')
+            ->first();
+
+        $uniqueVisitors = max(0, (int) ($summary?->unique_visitors ?? 0));
+        $engagedViews = max(0, (int) ($summary?->engaged_views ?? 0));
+        $scroll100 = max(0, (int) ($summary?->scroll_100 ?? 0));
+
+        return [
+            'views' => max(0, (int) ($summary?->views ?? 0)),
+            'uniqueVisitors' => $uniqueVisitors,
+            'engagedViews' => $engagedViews,
+            'scroll50' => max(0, (int) ($summary?->scroll_50 ?? 0)),
+            'scroll75' => max(0, (int) ($summary?->scroll_75 ?? 0)),
+            'scroll100' => $scroll100,
+            'avgEngagedSeconds' => round((float) ($summary?->avg_engaged_seconds ?? 0), 1),
+            'popularityScore' => round((float) ($summary?->popularity_score ?? 0), 2),
+            'engagementRate' => $uniqueVisitors > 0 ? round(($engagedViews / $uniqueVisitors) * 100, 1) : 0.0,
+            'deepScrollRate' => $uniqueVisitors > 0 ? round(($scroll100 / $uniqueVisitors) * 100, 1) : 0.0,
+        ];
+    }
+
+    /**
+     * @return array{0: Carbon, 1: Carbon}
+     */
+    private function previousRange(Carbon $from, Carbon $to): array
+    {
+        $days = $from->copy()->startOfDay()->diffInDays($to->copy()->startOfDay()) + 1;
+
+        return [
+            $from->copy()->subDays($days)->startOfDay(),
+            $from->copy()->subDay()->endOfDay(),
+        ];
+    }
+
+    private function percentDelta(int|float $current, int|float $previous): ?float
+    {
+        if ((float) $previous === 0.0) {
+            return (float) $current === 0.0 ? 0.0 : null;
+        }
+
+        return round((((float) $current - (float) $previous) / (float) $previous) * 100, 1);
+    }
+
+    /**
+     * @return array{totalViews:int,totalVisitors:int,periods:list<array<string,int|float|string>>}
+     */
+    private function popularPromptPeriodUsage(Carbon $from, Carbon $to): array
+    {
+        $events = AcademyEvent::query()
+            ->whereBetween('occurred_at', [$from, $to])
+            ->where('event_type', AcademyAnalyticsEventType::PAGE_VIEW)
+            ->where('content_type', AcademyAnalyticsContentType::PROMPT_POPULAR)
+            ->get(['visitor_id', 'metadata']);
+
+        $summary = [];
+        $totalViews = 0;
+        $visitorBuckets = [];
+
+        foreach ($events as $event) {
+            $metadata = is_array($event->metadata) ? $event->metadata : [];
+            $period = trim((string) ($metadata['period'] ?? ''));
+
+            if ($period === '') {
+                continue;
+            }
+
+            $days = max(0, (int) ($metadata['period_days'] ?? 0));
+
+            if (! isset($summary[$period])) {
+                $summary[$period] = [
+                    'period' => $period,
+                    'label' => sprintf('%s days', $days > 0 ? $days : (int) preg_replace('/\D+/', '', $period)),
+                    'views' => 0,
+                    'uniqueVisitors' => 0,
+                    'share' => 0.0,
+                    'days' => $days,
+                ];
+                $visitorBuckets[$period] = [];
+            }
+
+            $summary[$period]['views']++;
+            $totalViews++;
+
+            $visitorId = trim((string) ($event->visitor_id ?? ''));
+            if ($visitorId !== '') {
+                $visitorBuckets[$period][$visitorId] = true;
+            }
+        }
+
+        $totalVisitors = 0;
+
+        foreach ($summary as $period => &$row) {
+            $uniqueVisitors = count($visitorBuckets[$period] ?? []);
+            $row['uniqueVisitors'] = $uniqueVisitors;
+            $row['share'] = $totalViews > 0 ? round((((int) $row['views']) / $totalViews) * 100, 1) : 0.0;
+            $totalVisitors += $uniqueVisitors;
+        }
+        unset($row);
+
+        usort($summary, static function (array $left, array $right): int {
+            if ((int) $right['views'] === (int) $left['views']) {
+                return ((int) $left['days']) <=> ((int) $right['days']);
+            }
+
+            return ((int) $right['views']) <=> ((int) $left['views']);
+        });
+
+        return [
+            'totalViews' => $totalViews,
+            'totalVisitors' => $totalVisitors,
+            'periods' => array_values($summary),
+        ];
+    }
+
+    /**
+     * @param  Collection<int, mixed>  $rows
+     * @return Collection<int, array<string, mixed>>
+     */
+    private function serializeContentRows(Collection $rows, bool $includeConversion = false): Collection
+    {
+        return $rows->map(function ($row) use ($includeConversion): array {
+            $contentType = (string) $row->content_type;
+            $contentId = $row->content_id ? (int) $row->content_id : null;
+            $title = $this->resolver->title($contentType, $contentId);
+            $accessLevel = $this->resolver->accessLevel($contentType, $contentId);
+            $uniqueVisitors = max(0, (int) ($row->unique_visitors ?? 0));
+            $promptCopies = max(0, (int) ($row->prompt_copies ?? 0));
+            $likes = max(0, (int) ($row->likes ?? 0));
+            $saves = max(0, (int) ($row->saves ?? 0));
+            $starts = max(0, (int) ($row->starts ?? 0));
+            $completions = max(0, (int) ($row->completions ?? 0));
+            $premiumPreviewViews = max(0, (int) ($row->premium_preview_views ?? 0));
+            $upgradeClicks = max(0, (int) ($row->upgrade_clicks ?? 0));
+
+            return [
+                'content_type' => $contentType,
+                'content_type_label' => (string) Str::of(str_replace('academy_', '', $contentType))->replace('_', ' ')->headline(),
+                'content_id' => $contentId,
+                'title' => $title,
+                'access_level' => $accessLevel,
+                'views' => (int) ($row->views ?? 0),
+                'unique_visitors' => $uniqueVisitors,
+                'engaged_views' => (int) ($row->engaged_views ?? 0),
+                'likes' => $likes,
+                'saves' => $saves,
+                'prompt_copies' => $promptCopies,
+                'starts' => $starts,
+                'completions' => $completions,
+                'upgrade_clicks' => $upgradeClicks,
+                'popularity_score' => round((float) ($row->popularity_score ?? 0), 2),
+                'conversion_score' => round((float) ($row->conversion_score ?? 0), 2),
+                'copy_rate' => $uniqueVisitors > 0 ? round(($promptCopies / $uniqueVisitors) * 100, 1) : 0,
+                'save_rate' => $uniqueVisitors > 0 ? round(($saves / $uniqueVisitors) * 100, 1) : 0,
+                'like_rate' => $uniqueVisitors > 0 ? round(($likes / $uniqueVisitors) * 100, 1) : 0,
+                'completion_rate' => $starts > 0 ? round(($completions / $starts) * 100, 1) : 0,
+                'upgrade_rate' => max(1, $premiumPreviewViews) > 0 ? round(($upgradeClicks / max(1, $premiumPreviewViews)) * 100, 1) : 0,
+                'trend' => ((float) ($row->popularity_score ?? 0)) >= 100 ? 'High momentum' : (((float) ($row->popularity_score ?? 0)) >= 25 ? 'Building' : 'Early'),
+                'include_conversion' => $includeConversion,
+            ];
+        });
+    }
+
+    /**
+     * @return array{0: Carbon, 1: Carbon, 2: string}
+     */
+    private function resolveDateRange(Request $request, string $defaultRange = '7d'): array
+    {
+        $range = trim((string) $request->query('range', $defaultRange));
+
+        return match ($range) {
+            'today' => [now()->startOfDay(), now()->endOfDay(), 'today'],
+            'yesterday' => [now()->subDay()->startOfDay(), now()->subDay()->endOfDay(), 'yesterday'],
+            '30d' => [now()->subDays(29)->startOfDay(), now()->endOfDay(), '30d'],
+            '90d' => [now()->subDays(89)->startOfDay(), now()->endOfDay(), '90d'],
+            'custom' => [
+                Carbon::parse((string) $request->query('from', now()->subDays(6)->toDateString()))->startOfDay(),
+                Carbon::parse((string) $request->query('to', now()->toDateString()))->endOfDay(),
+                'custom',
+            ],
+            default => [now()->subDays(6)->startOfDay(), now()->endOfDay(), '7d'],
+        };
+    }
+
+    /**
+     * @return list<array<string, string|bool>>
+     */
+    private function nav(): array
+    {
+        return [
+            ['label' => 'Overview', 'href' => route('admin.academy.analytics.overview')],
+            ['label' => 'Intelligence', 'href' => route('admin.academy.analytics.intelligence')],
+            ['label' => 'Content', 'href' => route('admin.academy.analytics.content')],
+            ['label' => 'Prompt Library', 'href' => route('admin.academy.analytics.prompt-library')],
+            ['label' => 'Prompts', 'href' => route('admin.academy.analytics.prompts')],
+            ['label' => 'Lessons', 'href' => route('admin.academy.analytics.lessons')],
+            ['label' => 'Courses', 'href' => route('admin.academy.analytics.courses')],
+            ['label' => 'Search', 'href' => route('admin.academy.analytics.search')],
+            ['label' => 'Funnel', 'href' => route('admin.academy.analytics.funnel')],
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function rangePayload(string $activeRange, Carbon $from, Carbon $to): array
+    {
+        return [
+            'active' => $activeRange,
+            'from' => $from->toDateString(),
+            'to' => $to->toDateString(),
+            'options' => [
+                ['value' => 'today', 'label' => 'Today'],
+                ['value' => 'yesterday', 'label' => 'Yesterday'],
+                ['value' => '7d', 'label' => 'Last 7 days'],
+                ['value' => '30d', 'label' => 'Last 30 days'],
+                ['value' => '90d', 'label' => 'Last 90 days'],
+                ['value' => 'custom', 'label' => 'Custom range'],
+            ],
+        ];
+    }
+}

app/Http/Controllers/Settings/AcademyLessonMediaApiController.php

@@ -26,6 +26,11 @@ final class AcademyLessonMediaApiController extends Controller
 
     private const ASSET_CACHE_TTL_MINUTES = 15;
 
+    private const RESPONSIVE_VARIANT_WIDTHS = [
+        'thumb' => 480,
+        'md' => 960,
+    ];
+
     private ?ImageManager $manager = null;
 
     public function __construct()
@@ -68,6 +73,18 @@ final class AcademyLessonMediaApiController extends Controller
                 'slot' => $slot,
                 'path' => $stored['path'],
                 'url' => $this->publicUrlForPath($stored['path']),
+                'thumb_path' => $stored['thumb_path'],
+                'thumb_url' => $this->publicUrlForPath($stored['thumb_path']),
+                'thumb_width' => $stored['thumb_width'],
+                'thumb_height' => $stored['thumb_height'],
+                'medium_path' => $stored['medium_path'],
+                'medium_url' => $stored['medium_path'] !== '' ? $this->publicUrlForPath($stored['medium_path']) : null,
+                'medium_width' => $stored['medium_width'],
+                'medium_height' => $stored['medium_height'],
+                'srcset' => $this->buildResponsiveSrcset([
+                    ['path' => $stored['thumb_path'], 'width' => $stored['thumb_width']],
+                    ['path' => $stored['medium_path'], 'width' => $stored['medium_width']],
+                ]),
                 'width' => $stored['width'],
                 'height' => $stored['height'],
                 'mime_type' => 'image/webp',
@@ -161,7 +178,7 @@ final class AcademyLessonMediaApiController extends Controller
     }
 
     /**
-     * @return array{path:string,width:int,height:int,size_bytes:int}
+     * @return array{path:string,thumb_path:string,thumb_width:int,thumb_height:int,medium_path:string,medium_width:int|null,medium_height:int|null,width:int,height:int,size_bytes:int}
      */
     private function storeMediaFile(UploadedFile $file, string $slot): array
     {
@@ -202,14 +219,99 @@ final class AcademyLessonMediaApiController extends Controller
             ));
         }
 
-        $image = $this->manager->read($raw)->scaleDown(width: $constraints['max_width'], height: $constraints['max_height']);
+        $encodedImage = $this->encodeScaledMedia($raw, $constraints['max_width'], $constraints['max_height']);
-        $encoded = (string) $image->encode(new WebpEncoder(85));
+        $encoded = $encodedImage['binary'];
 
         $hash = hash('sha256', $encoded);
         $path = $this->mediaPath($hash, $slot);
         $disk = Storage::disk($this->mediaDiskName());
 
-        $written = $disk->put($path, $encoded, [
+        $this->writeMediaBinary($disk, $path, $encoded);
+
+        $thumbVariant = $this->storeResponsiveVariant(
+            $disk,
+            $raw,
+            $constraints,
+            $path,
+            'thumb',
+            self::RESPONSIVE_VARIANT_WIDTHS['thumb'],
+            $encodedImage['width'],
+            $encodedImage['height'],
+        );
+
+        $mediumVariant = $this->storeResponsiveVariant(
+            $disk,
+            $raw,
+            $constraints,
+            $path,
+            'md',
+            self::RESPONSIVE_VARIANT_WIDTHS['md'],
+            $encodedImage['width'],
+            $encodedImage['height'],
+        );
+
+        return [
+            'path' => $path,
+            'thumb_path' => $thumbVariant['path'] ?? $path,
+            'thumb_width' => $thumbVariant['width'] ?? $encodedImage['width'],
+            'thumb_height' => $thumbVariant['height'] ?? $encodedImage['height'],
+            'medium_path' => $mediumVariant['path'] ?? '',
+            'medium_width' => $mediumVariant['width'] ?? null,
+            'medium_height' => $mediumVariant['height'] ?? null,
+            'width' => $encodedImage['width'],
+            'height' => $encodedImage['height'],
+            'size_bytes' => strlen($encoded),
+        ];
+    }
+
+    /**
+     * @return array{binary:string,width:int,height:int}
+     */
+    private function encodeScaledMedia(string $raw, int $maxWidth, int $maxHeight): array
+    {
+        $image = $this->manager->read($raw)->scaleDown(width: $maxWidth, height: $maxHeight);
+        $encoded = (string) $image->encode(new WebpEncoder(85));
+
+        if ($encoded === '') {
+            throw new RuntimeException('Unable to encode image to WebP.');
+        }
+
+        return [
+            'binary' => $encoded,
+            'width' => (int) $image->width(),
+            'height' => (int) $image->height(),
+        ];
+    }
+
+    /**
+     * @param  array{max_width:int,max_height:int}  $constraints
+     * @return array{path:string,width:int,height:int}|null
+     */
+    private function storeResponsiveVariant($disk, string $raw, array $constraints, string $path, string $variant, int $targetWidth, int $sourceWidth, int $sourceHeight): ?array
+    {
+        if ($sourceWidth <= $targetWidth && $sourceHeight <= $constraints['max_height']) {
+            return null;
+        }
+
+        $encodedVariant = $this->encodeScaledMedia($raw, $targetWidth, $constraints['max_height']);
+
+        if ($encodedVariant['width'] >= $sourceWidth && $encodedVariant['height'] >= $sourceHeight) {
+            return null;
+        }
+
+        $variantPath = $this->responsiveVariantPath($path, $variant);
+        $this->writeMediaBinary($disk, $variantPath, $encodedVariant['binary']);
+
+        return [
+            'path' => $variantPath,
+            'width' => $encodedVariant['width'],
+            'height' => $encodedVariant['height'],
+        ];
+    }
+
+    private function writeMediaBinary($disk, string $path, string $binary): void
+    {
+        $written = $disk->put($path, $binary, [
             'visibility' => 'public',
             'CacheControl' => 'public, max-age=31536000, immutable',
             'ContentType' => 'image/webp',
@@ -218,13 +320,6 @@ final class AcademyLessonMediaApiController extends Controller
         if ($written !== true) {
             throw new RuntimeException('Unable to store image in object storage.');
         }
-
-        return [
-            'path' => $path,
-            'width' => (int) $image->width(),
-            'height' => (int) $image->height(),
-            'size_bytes' => strlen($encoded),
-        ];
     }
 
     private function authorizeStaff(Request $request): void
@@ -255,6 +350,54 @@ final class AcademyLessonMediaApiController extends Controller
         return rtrim((string) config('cdn.files_url', 'https://files.skinbase.org'), '/') . '/' . ltrim($path, '/');
     }
 
+    /**
+     * @param  array<int, array{path:string,width:int|null}>  $variants
+     */
+    private function buildResponsiveSrcset(array $variants): ?string
+    {
+        $entries = collect($variants)
+            ->filter(function (array $variant): bool {
+                return trim((string) ($variant['path'] ?? '')) !== '' && (int) ($variant['width'] ?? 0) > 0;
+            })
+            ->unique(fn (array $variant): string => trim((string) ($variant['path'] ?? '')))
+            ->map(fn (array $variant): string => sprintf('%s %dw', $this->publicUrlForPath((string) $variant['path']), (int) $variant['width']))
+            ->values()
+            ->all();
+
+        return $entries !== [] ? implode(', ', $entries) : null;
+    }
+
+    private function responsiveVariantPath(string $path, string $variant): string
+    {
+        $directory = pathinfo($path, PATHINFO_DIRNAME);
+        $filename = pathinfo($path, PATHINFO_FILENAME);
+
+        return sprintf(
+            '%s/%s-%s.webp',
+            $directory === '.' ? '' : $directory,
+            preg_replace('/-(thumb|md)$/', '', $filename) ?? $filename,
+            $variant,
+        );
+    }
+
+    private function canonicalMediaPath(string $path): string
+    {
+        $directory = pathinfo($path, PATHINFO_DIRNAME);
+        $filename = pathinfo($path, PATHINFO_FILENAME);
+        $baseFilename = preg_replace('/-(thumb|md)$/', '', $filename) ?? $filename;
+
+        return sprintf(
+            '%s/%s.webp',
+            $directory === '.' ? '' : $directory,
+            $baseFilename,
+        );
+    }
+
+    private function isResponsiveVariantPath(string $path): bool
+    {
+        return preg_match('/-(thumb|md)\.webp$/i', $path) === 1;
+    }
+
     private function academyAssetManifest(): Collection
     {
         return Cache::remember($this->academyAssetCacheKey(), now()->addMinutes(self::ASSET_CACHE_TTL_MINUTES), function (): Collection {
@@ -262,6 +405,7 @@ final class AcademyLessonMediaApiController extends Controller
 
             return collect($disk->allFiles('academy/lessons'))
                 ->filter(fn (string $path): bool => Str::endsWith(Str::lower($path), ['.webp', '.jpg', '.jpeg', '.png']))
+                ->reject(fn (string $path): bool => $this->isResponsiveVariantPath($path))
                 ->map(function (string $path) use ($disk): array {
                     $modifiedAt = null;
 
@@ -323,7 +467,14 @@ final class AcademyLessonMediaApiController extends Controller
             return;
         }
 
-        Storage::disk($this->mediaDiskName())->delete($trimmed);
+        $basePath = $this->canonicalMediaPath($trimmed);
+        $paths = [
+            $basePath,
+            $this->responsiveVariantPath($basePath, 'thumb'),
+            $this->responsiveVariantPath($basePath, 'md'),
+        ];
+
+        Storage::disk($this->mediaDiskName())->delete(array_values(array_unique($paths)));
     }
 
     private function normalizeSlot(mixed $slot): string
@@ -346,8 +497,8 @@ final class AcademyLessonMediaApiController extends Controller
         }
 
         return [
-            'min_width' => 1200,
+            'min_width' => 600,
-            'min_height' => 630,
+            'min_height' => 315,
             'max_width' => 2200,
             'max_height' => 1400,
         ];

app/Http/Controllers/Settings/FeaturedArtworkAdminController.php

@@ -27,8 +27,10 @@ class FeaturedArtworkAdminController extends Controller
     {
         $isAdminSurface = $request->routeIs('admin.artworks.featured.*');
         $routePrefix = $isAdminSurface ? 'admin.artworks.featured.' : 'admin.cp.artworks.featured.';
+        $pageName = $isAdminSurface ? 'Moderation/FeaturedArtworks' : 'Collection/FeaturedArtworksAdmin';
+        $rootView = $isAdminSurface ? 'moderation' : 'collections';
 
-        return Inertia::render($isAdminSurface ? 'Admin/FeaturedArtworks' : 'Collection/FeaturedArtworksAdmin', array_merge(
+        return Inertia::render($pageName, array_merge(
             $this->featuredArtworks->pageProps(),
             [
                 'endpoints' => [
@@ -49,7 +51,7 @@ class FeaturedArtworkAdminController extends Controller
                     'robots' => 'index,follow',
                 ],
             ],
-        ))->rootView($isAdminSurface ? 'admin' : 'collections');
+        ))->rootView($rootView);
     }
 
     public function search(Request $request): JsonResponse

app/Http/Controllers/Settings/WorldWebStoryAdminController.php

@@ -0,0 +1,512 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Settings;
+
+use App\Http\Controllers\Controller;
+use App\Models\World;
+use App\Models\WorldWebStory;
+use App\Models\WorldWebStoryPage;
+use App\Services\WebStories\WorldWebStoryAssetService;
+use App\Services\WebStories\WorldWebStoryGenerator;
+use App\Services\WebStories\WorldWebStoryValidationService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Inertia\Response;
+
+final class WorldWebStoryAdminController extends Controller
+{
+    private const PER_PAGE = 20;
+
+    public function __construct(
+        private readonly WorldWebStoryGenerator $generator,
+        private readonly WorldWebStoryAssetService $assets,
+        private readonly WorldWebStoryValidationService $validation,
+    ) {
+    }
+
+    public function index(Request $request): Response
+    {
+        $filters = [
+            'q' => trim((string) $request->query('q', '')),
+            'status' => trim((string) $request->query('status', 'all')),
+        ];
+
+        $stories = WorldWebStory::query()
+            ->with('world')
+            ->when($filters['q'] !== '', function ($query) use ($filters): void {
+                $query->where(function ($nested) use ($filters): void {
+                    $nested->where('title', 'like', '%' . $filters['q'] . '%')
+                        ->orWhere('slug', 'like', '%' . $filters['q'] . '%')
+                        ->orWhereHas('world', fn ($worldQuery) => $worldQuery->where('title', 'like', '%' . $filters['q'] . '%')->orWhere('slug', 'like', '%' . $filters['q'] . '%'));
+                });
+            })
+            ->when($filters['status'] !== 'all', fn ($query) => $query->where('status', $filters['status']))
+            ->orderByDesc('published_at')
+            ->orderByDesc('updated_at')
+            ->paginate(self::PER_PAGE)
+            ->withQueryString()
+            ->through(fn (WorldWebStory $story): array => $this->mapStoryListItem($story));
+
+        return Inertia::render('Moderation/WorldWebStoriesIndex', [
+            'title' => 'World Web Stories',
+            'stories' => $stories,
+            'filters' => $filters,
+            'stats' => [
+                'total' => WorldWebStory::query()->count(),
+                'published' => WorldWebStory::query()->where('status', WorldWebStory::STATUS_PUBLISHED)->count(),
+                'draft' => WorldWebStory::query()->where('status', WorldWebStory::STATUS_DRAFT)->count(),
+                'hidden' => WorldWebStory::query()->where('noindex', true)->orWhere('active', false)->count(),
+            ],
+            'worldOptions' => $this->worldOptions(),
+            'endpoints' => [
+                'index' => route('admin.web-stories.index'),
+                'create' => route('admin.web-stories.create'),
+                'editPattern' => route('admin.web-stories.edit', ['story' => '__STORY__']),
+                'destroyPattern' => route('admin.web-stories.destroy', ['story' => '__STORY__']),
+                'publishPattern' => route('admin.web-stories.publish', ['story' => '__STORY__']),
+                'unpublishPattern' => route('admin.web-stories.unpublish', ['story' => '__STORY__']),
+                'generatePattern' => route('admin.web-stories.generate', ['world' => '__WORLD__']),
+            ],
+        ])->rootView('moderation');
+    }
+
+    public function create(): Response
+    {
+        return Inertia::render('Moderation/WorldWebStoryEditor', [
+            'story' => $this->blankStoryPayload(),
+            'worldOptions' => $this->worldOptions(),
+            'endpoints' => $this->editorEndpoints(),
+            'isNew' => true,
+        ])->rootView('moderation');
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $attributes = $this->validatedStoryAttributes($request);
+        $story = new WorldWebStory();
+        $story->fill($attributes + [
+            'created_by' => (int) $request->user()->id,
+            'updated_by' => (int) $request->user()->id,
+        ]);
+        $this->normalizeStatusTimestamps($story);
+        $this->assertPublishedStateIsValid($story);
+        $story->save();
+
+        return redirect()->route('admin.web-stories.edit', ['story' => $story])->with('success', 'Web story created.');
+    }
+
+    public function edit(WorldWebStory $story): Response
+    {
+        $story->load(['world', 'orderedPages.artwork']);
+
+        return Inertia::render('Moderation/WorldWebStoryEditor', [
+            'story' => $this->mapStoryEditorPayload($story),
+            'worldOptions' => $this->worldOptions(),
+            'endpoints' => $this->editorEndpoints($story),
+            'isNew' => false,
+        ])->rootView('moderation');
+    }
+
+    public function update(Request $request, WorldWebStory $story): RedirectResponse
+    {
+        $story->fill($this->validatedStoryAttributes($request) + [
+            'updated_by' => (int) $request->user()->id,
+        ]);
+        $this->normalizeStatusTimestamps($story);
+        $this->assertPublishedStateIsValid($story);
+        $story->save();
+
+        return back()->with('success', 'Web story updated.');
+    }
+
+    public function destroy(WorldWebStory $story): JsonResponse
+    {
+        $story->delete();
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Web story deleted.',
+        ]);
+    }
+
+    public function storePage(Request $request, WorldWebStory $story): JsonResponse
+    {
+        $attributes = $this->validatedPageAttributes($request, $story, null);
+        $page = $story->pages()->create($attributes);
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Page created.',
+            'page' => $this->mapPage($page->fresh('artwork')),
+        ]);
+    }
+
+    public function updatePage(Request $request, WorldWebStory $story, WorldWebStoryPage $page): JsonResponse
+    {
+        abort_unless((int) $page->story_id === (int) $story->id, 404);
+
+        $page->fill($this->validatedPageAttributes($request, $story, $page));
+        $page->save();
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Page updated.',
+            'page' => $this->mapPage($page->fresh('artwork')),
+        ]);
+    }
+
+    public function destroyPage(WorldWebStory $story, WorldWebStoryPage $page): JsonResponse
+    {
+        abort_unless((int) $page->story_id === (int) $story->id, 404);
+
+        $page->delete();
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Page deleted.',
+        ]);
+    }
+
+    public function reorderPages(Request $request, WorldWebStory $story): JsonResponse
+    {
+        $validated = $request->validate([
+            'page_ids' => ['required', 'array', 'min:1'],
+            'page_ids.*' => ['integer'],
+        ]);
+
+        $ids = collect($validated['page_ids'])->map(fn ($id): int => (int) $id)->values();
+        $pages = $story->orderedPages()->whereIn('id', $ids)->get()->keyBy('id');
+
+        abort_unless($pages->count() === $ids->count(), 422);
+
+        foreach ($ids as $index => $id) {
+            $pages[$id]->forceFill(['position' => $index + 1])->save();
+        }
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Page order updated.',
+        ]);
+    }
+
+    public function generateFromWorld(Request $request, World $world): JsonResponse
+    {
+        $validated = $request->validate([
+            'force' => ['nullable', 'boolean'],
+            'publish' => ['nullable', 'boolean'],
+            'dry_run' => ['nullable', 'boolean'],
+            'pages' => ['nullable', 'integer', 'min:5', 'max:10'],
+        ]);
+
+        $result = $this->generator->generateFromWorld(
+            $world,
+            $request->user(),
+            (int) ($validated['pages'] ?? 7),
+            (bool) ($validated['force'] ?? false),
+            (bool) ($validated['publish'] ?? false),
+            (bool) ($validated['dry_run'] ?? false),
+        );
+
+        return response()->json([
+            'ok' => true,
+            'message' => $result['created'] ? 'Web story draft generated.' : 'Web story draft regenerated.',
+            'story' => [
+                'id' => $result['story']->id,
+                'slug' => $result['story']->slug,
+                'edit_url' => $result['story']->exists ? route('admin.web-stories.edit', ['story' => $result['story']->id]) : null,
+            ],
+            'validation' => $result['validation'],
+        ]);
+    }
+
+    public function publish(WorldWebStory $story): JsonResponse
+    {
+        $this->assets->buildAssets($story, force: false);
+        $story->refresh()->load('orderedPages');
+        $this->validation->assertPublishable($story);
+        $story->forceFill([
+            'status' => WorldWebStory::STATUS_PUBLISHED,
+            'published_at' => $story->published_at ?: now(),
+        ])->save();
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Web story published.',
+        ]);
+    }
+
+    public function unpublish(WorldWebStory $story): JsonResponse
+    {
+        $story->forceFill([
+            'status' => WorldWebStory::STATUS_DRAFT,
+            'published_at' => null,
+        ])->save();
+
+        return response()->json([
+            'ok' => true,
+            'message' => 'Web story reverted to draft.',
+        ]);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function validatedStoryAttributes(Request $request, ?WorldWebStory $story = null): array
+    {
+        $validated = $request->validate([
+            'world_id' => ['nullable', 'integer', Rule::exists('worlds', 'id')],
+            'slug' => ['required', 'string', 'max:120', Rule::unique('world_web_stories', 'slug')->ignore($story?->id)],
+            'title' => ['required', 'string', 'max:255'],
+            'subtitle' => ['nullable', 'string', 'max:255'],
+            'excerpt' => ['nullable', 'string', 'max:400'],
+            'description' => ['nullable', 'string', 'max:2000'],
+            'seo_title' => ['nullable', 'string', 'max:255'],
+            'seo_description' => ['nullable', 'string', 'max:400'],
+            'poster_portrait_path' => ['nullable', 'string', 'max:2048'],
+            'poster_square_path' => ['nullable', 'string', 'max:2048'],
+            'publisher_logo_path' => ['nullable', 'string', 'max:2048'],
+            'status' => ['required', Rule::in([WorldWebStory::STATUS_DRAFT, WorldWebStory::STATUS_PUBLISHED, WorldWebStory::STATUS_ARCHIVED])],
+            'featured' => ['required', 'boolean'],
+            'active' => ['required', 'boolean'],
+            'noindex' => ['required', 'boolean'],
+            'published_at' => ['nullable', 'date'],
+            'starts_at' => ['nullable', 'date'],
+            'ends_at' => ['nullable', 'date', 'after_or_equal:starts_at'],
+        ]);
+
+        return $validated;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function validatedPageAttributes(Request $request, WorldWebStory $story, ?WorldWebStoryPage $page): array
+    {
+        $validated = $request->validate([
+            'artwork_id' => ['nullable', 'integer', Rule::exists('artworks', 'id')],
+            'position' => ['nullable', 'integer', 'min:1'],
+            'layout' => ['required', Rule::in([
+                WorldWebStoryPage::LAYOUT_COVER,
+                WorldWebStoryPage::LAYOUT_ARTWORK,
+                WorldWebStoryPage::LAYOUT_CREATOR,
+                WorldWebStoryPage::LAYOUT_MOOD,
+                WorldWebStoryPage::LAYOUT_COLLECTION,
+                WorldWebStoryPage::LAYOUT_CTA,
+            ])],
+            'background_type' => ['required', Rule::in([
+                WorldWebStoryPage::BACKGROUND_IMAGE,
+                WorldWebStoryPage::BACKGROUND_VIDEO,
+                WorldWebStoryPage::BACKGROUND_GRADIENT,
+            ])],
+            'background_path' => ['nullable', 'string', 'max:2048'],
+            'background_mobile_path' => ['nullable', 'string', 'max:2048'],
+            'headline' => ['nullable', 'string', 'max:255'],
+            'body' => ['nullable', 'string', 'max:180'],
+            'cta_label' => ['nullable', 'string', 'max:120'],
+            'cta_url' => ['nullable', 'string', 'max:2048'],
+            'alt_text' => ['required', 'string', 'max:255'],
+            'caption' => ['nullable', 'string', 'max:120'],
+            'credit_text' => ['nullable', 'string', 'max:255'],
+            'text_position' => ['required', Rule::in(['top', 'center', 'bottom'])],
+            'overlay_strength' => ['required', 'integer', 'min:0', 'max:100'],
+            'animation' => ['nullable', Rule::in(['fade-in', 'fly-in-bottom', 'pulse', 'pan-left', 'pan-right'])],
+            'active' => ['required', 'boolean'],
+        ]);
+
+        $validated['position'] = (int) ($validated['position'] ?? ($story->orderedPages()->max('position') + ($page ? 0 : 1) ?: 1));
+        $pageErrors = $this->validation->validatePagePayload($validated);
+
+        if ($pageErrors !== []) {
+            throw ValidationException::withMessages($pageErrors);
+        }
+
+        return $validated;
+    }
+
+    private function normalizeStatusTimestamps(WorldWebStory $story): void
+    {
+        if ((string) $story->status === WorldWebStory::STATUS_PUBLISHED && $story->published_at === null) {
+            $story->published_at = now();
+        }
+
+        if ((string) $story->status === WorldWebStory::STATUS_DRAFT) {
+            $story->published_at = null;
+        }
+    }
+
+    private function assertPublishedStateIsValid(WorldWebStory $story): void
+    {
+        if ((string) $story->status !== WorldWebStory::STATUS_PUBLISHED) {
+            return;
+        }
+
+        $story->loadMissing('orderedPages');
+        $this->validation->assertPublishable($story);
+    }
+
+    /**
+     * @return array<int, array{value:int,label:string,description:string}>
+     */
+    private function worldOptions(): array
+    {
+        return World::query()
+            ->orderByDesc('published_at')
+            ->orderBy('title')
+            ->limit(200)
+            ->get(['id', 'title', 'slug'])
+            ->map(fn (World $world): array => [
+                'value' => (int) $world->id,
+                'label' => (string) $world->title,
+                'description' => (string) $world->slug,
+            ])
+            ->all();
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function blankStoryPayload(): array
+    {
+        return [
+            'id' => null,
+            'world_id' => null,
+            'slug' => '',
+            'title' => '',
+            'subtitle' => '',
+            'excerpt' => '',
+            'description' => '',
+            'seo_title' => '',
+            'seo_description' => '',
+            'poster_portrait_path' => '',
+            'poster_square_path' => '',
+            'publisher_logo_path' => $this->assets->defaultPublisherLogoPath(),
+            'status' => WorldWebStory::STATUS_DRAFT,
+            'featured' => false,
+            'active' => true,
+            'noindex' => false,
+            'published_at' => null,
+            'starts_at' => null,
+            'ends_at' => null,
+            'world' => null,
+            'pages' => [],
+            'public_url' => null,
+            'validation' => ['valid' => false, 'errors' => [], 'warnings' => [], 'page_count' => 0],
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapStoryEditorPayload(WorldWebStory $story): array
+    {
+        return [
+            'id' => (int) $story->id,
+            'world_id' => $story->world_id ? (int) $story->world_id : null,
+            'slug' => (string) $story->slug,
+            'title' => (string) $story->title,
+            'subtitle' => (string) ($story->subtitle ?? ''),
+            'excerpt' => (string) ($story->excerpt ?? ''),
+            'description' => (string) ($story->description ?? ''),
+            'seo_title' => (string) ($story->seo_title ?? ''),
+            'seo_description' => (string) ($story->seo_description ?? ''),
+            'poster_portrait_path' => (string) ($story->poster_portrait_path ?? ''),
+            'poster_square_path' => (string) ($story->poster_square_path ?? ''),
+            'publisher_logo_path' => (string) ($story->publisher_logo_path ?? ''),
+            'status' => (string) $story->status,
+            'featured' => (bool) $story->featured,
+            'active' => (bool) $story->active,
+            'noindex' => (bool) $story->noindex,
+            'published_at' => optional($story->published_at)?->toIso8601String(),
+            'starts_at' => optional($story->starts_at)?->toIso8601String(),
+            'ends_at' => optional($story->ends_at)?->toIso8601String(),
+            'world' => $story->world ? [
+                'id' => (int) $story->world->id,
+                'title' => (string) $story->world->title,
+                'slug' => (string) $story->world->slug,
+            ] : null,
+            'pages' => $story->orderedPages->map(fn (WorldWebStoryPage $page): array => $this->mapPage($page))->all(),
+            'public_url' => route('web-stories.show', ['slug' => $story->slug]),
+            'validation' => $this->validation->validate($story),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapStoryListItem(WorldWebStory $story): array
+    {
+        return [
+            'id' => (int) $story->id,
+            'slug' => (string) $story->slug,
+            'title' => (string) $story->title,
+            'excerpt' => (string) ($story->excerpt ?? ''),
+            'status' => (string) $story->status,
+            'active' => (bool) $story->active,
+            'noindex' => (bool) $story->noindex,
+            'featured' => (bool) $story->featured,
+            'page_count' => (int) ($story->pages()->count()),
+            'published_at' => optional($story->published_at)?->toIso8601String(),
+            'poster_portrait_url' => $story->posterPortraitUrl(),
+            'world' => $story->world ? [
+                'id' => (int) $story->world->id,
+                'title' => (string) $story->world->title,
+                'slug' => (string) $story->world->slug,
+            ] : null,
+            'public_url' => route('web-stories.show', ['slug' => $story->slug]),
+        ];
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function mapPage(WorldWebStoryPage $page): array
+    {
+        return [
+            'id' => (int) $page->id,
+            'artwork_id' => $page->artwork_id ? (int) $page->artwork_id : null,
+            'position' => (int) $page->position,
+            'layout' => (string) $page->layout,
+            'background_type' => (string) $page->background_type,
+            'background_path' => (string) ($page->background_path ?? ''),
+            'background_mobile_path' => (string) ($page->background_mobile_path ?? ''),
+            'headline' => (string) ($page->headline ?? ''),
+            'body' => (string) ($page->body ?? ''),
+            'cta_label' => (string) ($page->cta_label ?? ''),
+            'cta_url' => (string) ($page->cta_url ?? ''),
+            'alt_text' => (string) ($page->alt_text ?? ''),
+            'caption' => (string) ($page->caption ?? ''),
+            'credit_text' => (string) ($page->credit_text ?? ''),
+            'text_position' => (string) ($page->text_position ?? 'bottom'),
+            'overlay_strength' => (int) ($page->overlay_strength ?? 35),
+            'animation' => (string) ($page->animation ?? ''),
+            'active' => (bool) $page->active,
+            'background_url' => $page->backgroundUrl(),
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function editorEndpoints(?WorldWebStory $story = null): array
+    {
+        return [
+            'store' => route('admin.web-stories.store'),
+            'update' => $story ? route('admin.web-stories.update', ['story' => $story]) : '',
+            'destroy' => $story ? route('admin.web-stories.destroy', ['story' => $story]) : '',
+            'pagesStore' => $story ? route('admin.web-stories.pages.store', ['story' => $story]) : '',
+            'pagesUpdatePattern' => $story ? route('admin.web-stories.pages.update', ['story' => $story, 'page' => '__PAGE__']) : '',
+            'pagesDestroyPattern' => $story ? route('admin.web-stories.pages.destroy', ['story' => $story, 'page' => '__PAGE__']) : '',
+            'pagesReorder' => $story ? route('admin.web-stories.pages.reorder', ['story' => $story]) : '',
+            'publish' => $story ? route('admin.web-stories.publish', ['story' => $story]) : '',
+            'unpublish' => $story ? route('admin.web-stories.unpublish', ['story' => $story]) : '',
+            'generateFromWorldPattern' => route('admin.web-stories.generate', ['world' => '__WORLD__']),
+            'index' => route('admin.web-stories.index'),
+        ];
+    }
+}

app/Http/Controllers/SitemapController.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Http\Controllers;
 
 use App\Services\Sitemaps\PublishedSitemapResolver;
+use App\Services\Sitemaps\SitemapBuildService;
 use App\Services\Sitemaps\SitemapXmlRenderer;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -14,34 +15,50 @@ final class SitemapController extends Controller
 {
     public function __construct(
         private readonly PublishedSitemapResolver $published,
+        private readonly SitemapBuildService $build,
         private readonly SitemapXmlRenderer $renderer,
     ) {
     }
 
     public function index(): Response|BinaryFileResponse
     {
-        // 1. Static file written by the build/generate commands.
+        if ((bool) config('sitemaps.pre_generated.enabled', true)) {
-        //    On production nginx serves this directly via try_files without reaching PHP.
+            foreach ([
-        //    On dev / misconfigured servers we stream it with sendfile — no RAM load.
+                public_path('sitemaps/index.xml'),
-        $path = public_path('sitemap.xml');
+                public_path('sitemaps/sitemap.xml'),
-        if (file_exists($path)) {
+                public_path('sitemap.xml'),
+            ] as $path) {
+                if (is_file($path) && is_readable($path)) {
                     return $this->xmlFileResponse($path);
                 }
+            }
+        }
 
-        // 2. Published release (release management pipeline fallback).
+        // 1. Published release (release management pipeline fallback).
         $published = $this->published->resolveIndex();
         if ($published !== null) {
             return $this->renderer->xmlResponse($published['content']);
         }
 
+        // 2. Live-build fallback when no published sitemap is available.
+        if ((bool) config('sitemaps.delivery.fallback_to_live_build', true)) {
+            $built = $this->build->buildIndex(force: true, persist: false);
+
+            return $this->renderer->xmlResponse($built['content']);
+        }
+
         throw new NotFoundHttpException();
     }
 
     public function show(string $name): Response|BinaryFileResponse
     {
+        if ($name === 'sitemap') {
+            return $this->index();
+        }
+
         // 1. Static file.
         $path = public_path('sitemaps/' . $name . '.xml');
-        if (file_exists($path)) {
+        if ((bool) config('sitemaps.pre_generated.enabled', true) && file_exists($path)) {
             return $this->xmlFileResponse($path);
         }
 
@@ -51,6 +68,13 @@ final class SitemapController extends Controller
             return $this->renderer->xmlResponse($published['content']);
         }
 
+        if ((bool) config('sitemaps.delivery.fallback_to_live_build', true)) {
+            $built = $this->build->buildNamed($name, force: true, persist: false);
+            if ($built !== null) {
+                return $this->renderer->xmlResponse($built['content']);
+            }
+        }
+
         throw new NotFoundHttpException();
     }
 

app/Http/Controllers/Studio/StudioArtworksApiController.php

@@ -6,26 +6,34 @@ namespace App\Http\Controllers\Studio;
 
 use App\Http\Controllers\Controller;
 use App\Models\Artwork;
+use App\Models\ArtworkVersion;
 use App\Models\Category;
 use App\Models\ContentType;
-use App\Models\ArtworkVersion;
+use App\Notifications\NewArtworkReviewNotification;
-use App\Services\ArtworkEvolutionService;
+use App\Repositories\Uploads\ArtworkFileRepository;
-use App\Services\Cdn\ArtworkCdnPurgeService;
-use App\Services\ArtworkSearchIndexer;
 use App\Services\ArtworkAttributionService;
+use App\Services\ArtworkEvolutionService;
+use App\Services\Artworks\ArtworkCategoryService;
 use App\Services\Artworks\ArtworkPublicationService;
-use App\Services\TagService;
+use App\Services\ArtworkSearchIndexer;
 use App\Services\ArtworkVersioningService;
+use App\Services\Cdn\ArtworkCdnPurgeService;
+use App\Services\Moderation\ArtworkUploadPolicy;
 use App\Services\Studio\StudioArtworkQueryService;
 use App\Services\Studio\StudioBulkActionService;
 use App\Services\Tags\TagDiscoveryService;
+use App\Services\TagService;
+use App\Services\Uploads\UploadDerivativesService;
+use App\Services\Uploads\UploadStorageService;
 use App\Services\Worlds\WorldSubmissionService;
+use App\Support\ArtworkDescriptionContentValidator;
 use Carbon\Carbon;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
-use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\ValidationException;
 use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
@@ -44,6 +52,7 @@ final class StudioArtworksApiController extends Controller
         private readonly TagService $tagService,
         private readonly ArtworkCdnPurgeService $cdnPurge,
         private readonly ArtworkPublicationService $artworkPublication,
+        private readonly ArtworkCategoryService $artworkCategories,
     ) {}
 
     /**
@@ -126,7 +135,7 @@ final class StudioArtworksApiController extends Controller
      * PUT /api/studio/artworks/{id}
      * Update artwork details (title, description, visibility).
      */
-    public function update(Request $request, int $id, ArtworkAttributionService $attribution, WorldSubmissionService $submissions): JsonResponse
+    public function update(Request $request, int $id, ArtworkAttributionService $attribution, WorldSubmissionService $submissions, ArtworkUploadPolicy $uploadPolicy): JsonResponse
     {
         $artwork = $request->user()->artworks()->findOrFail($id);
         $evolution = app(ArtworkEvolutionService::class);
@@ -140,8 +149,11 @@ final class StudioArtworksApiController extends Controller
             'publish_at' => 'sometimes|nullable|string|date',
             'timezone' => 'sometimes|nullable|string|max:64',
             'category_id' => 'sometimes|nullable|integer|exists:categories,id',
+            'primary_category_id' => 'sometimes|nullable|integer|exists:categories,id',
+            'secondary_category_ids' => 'sometimes|array|max:'.(int) config('categories.max_secondary_categories', 5),
+            'secondary_category_ids.*' => 'integer|exists:categories,id',
             'content_type_id' => 'sometimes|nullable|integer|exists:content_types,id',
-            'tags'        => 'sometimes|array|max:' . (int) config('tags.max_user_tags', 30),
+            'tags' => 'sometimes|array|max:'.(int) config('tags.max_user_tags', 30),
             'tags.*' => 'string|max:64',
             'title_source' => 'sometimes|nullable|string|in:manual,ai_generated,ai_applied,mixed',
             'description_source' => 'sometimes|nullable|string|in:manual,ai_generated,ai_applied,mixed',
@@ -164,6 +176,8 @@ final class StudioArtworksApiController extends Controller
             'evolution_note' => 'sometimes|nullable|string|max:1200',
         ]);
 
+        $this->ensureValidArtworkDescription($validated);
+
         $hasAttributionUpdates = array_key_exists('group', $validated)
             || array_key_exists('primary_author_user_id', $validated)
             || array_key_exists('contributor_user_ids', $validated)
@@ -207,14 +221,18 @@ final class StudioArtworksApiController extends Controller
 
         // Extract tags and category before updating core fields
         $tags = $validated['tags'] ?? null;
-        $categoryId = $validated['category_id'] ?? null;
+        $categoryId = $validated['primary_category_id'] ?? $validated['category_id'] ?? null;
+        $secondaryCategoryIds = array_key_exists('secondary_category_ids', $validated)
+            ? array_values(array_map('intval', $validated['secondary_category_ids'] ?? []))
+            : [];
+        $hasSecondaryCategoryUpdate = array_key_exists('secondary_category_ids', $validated);
         $contentTypeId = $validated['content_type_id'] ?? null;
         $evolutionPayload = [
             'target_artwork_id' => $validated['evolution_target_artwork_id'] ?? null,
             'relation_type' => $validated['evolution_relation_type'] ?? null,
             'note' => $validated['evolution_note'] ?? null,
         ];
-        unset($validated['tags'], $validated['category_id'], $validated['content_type_id'], $validated['visibility'], $validated['mode'], $validated['publish_at'], $validated['timezone'], $validated['group'], $validated['primary_author_user_id'], $validated['contributor_user_ids'], $validated['contributor_credits'], $validated['world_submissions']);
+        unset($validated['tags'], $validated['category_id'], $validated['primary_category_id'], $validated['secondary_category_ids'], $validated['content_type_id'], $validated['visibility'], $validated['mode'], $validated['publish_at'], $validated['timezone'], $validated['group'], $validated['primary_author_user_id'], $validated['contributor_user_ids'], $validated['contributor_credits'], $validated['world_submissions']);
         unset($validated['evolution_target_artwork_id'], $validated['evolution_relation_type'], $validated['evolution_note']);
 
         $validated['visibility'] = $visibility;
@@ -228,9 +246,17 @@ final class StudioArtworksApiController extends Controller
             $validated['artwork_status'] = 'scheduled';
         } else {
             $validated['is_public'] = $visibility !== Artwork::VISIBILITY_PRIVATE;
-            $validated['is_approved'] = true;
+            $policy = $uploadPolicy->assess($request->user(), $artwork);
+            $validated['is_approved'] = ! $policy['requires_review'];
+            $validated['approval_source'] = $policy['requires_review'] ? null : 'trusted_auto';
             $validated['publish_at'] = null;
-            $validated['artwork_status'] = 'published';
+            $validated['artwork_status'] = $policy['requires_review'] ? 'review' : 'published';
+
+            if ($policy['requires_review']) {
+                $validated['is_public'] = false;
+                $validated['published_at'] = null;
+                $validated['moderation_note'] = implode(', ', $policy['reasons']);
+            }
 
             if (($validated['is_public'] ?? false) && ! $artwork->published_at) {
                 $validated['published_at'] = now();
@@ -246,10 +272,19 @@ final class StudioArtworksApiController extends Controller
         }
 
         $artwork->update($validated);
+        $requiresReview = ($policy['requires_review'] ?? false) === true;
 
-        // Sync category
+        if ($categoryId !== null || $hasSecondaryCategoryUpdate) {
-        if ($categoryId !== null) {
+            try {
-            $artwork->categories()->sync([(int) $categoryId]);
+                $this->artworkCategories->sync(
+                    $artwork,
+                    $categoryId !== null ? (int) $categoryId : (int) $artwork->primary_category_id,
+                    $hasSecondaryCategoryUpdate ? $secondaryCategoryIds : ($categoryId !== null ? [] : null),
+                    (string) ($validated['category_source'] ?? $artwork->category_source ?? 'manual'),
+                );
+            } catch (ValidationException $exception) {
+                return response()->json(['errors' => $exception->errors()], 422);
+            }
         }
 
         // Sync tags through the shared tag service so pivot source/usage rules stay valid.
@@ -288,12 +323,28 @@ final class StudioArtworksApiController extends Controller
         // Reindex in Meilisearch — dispatches IndexArtworkJob which writes directly, no Scout hop.
         $this->searchIndexer->update($artwork);
 
+        if ($requiresReview) {
+            $notifyEmail = trim((string) config('uploads.moderation.notify_email', ''));
+            if ($notifyEmail !== '') {
+                try {
+                    Notification::route('mail', $notifyEmail)->notify(
+                        new NewArtworkReviewNotification($artwork, $request->user(), $policy['reasons'])
+                    );
+                } catch (\Throwable) {
+                    // Keep the artwork private if notification delivery fails.
+                }
+            }
+        }
+
         // Reload relationships for response
-        $artwork->load(['categories.contentType', 'tags', 'group', 'primaryAuthor.profile', 'contributors.user.profile']);
+        $artwork->load(['categories.contentType', 'primaryCategory.contentType', 'tags', 'group', 'primaryAuthor.profile', 'contributors.user.profile']);
-        $primaryCategory = $artwork->categories->first();
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
 
         return response()->json([
             'success' => true,
+            'status' => $requiresReview ? 'submitted_for_review' : 'published',
+            'message' => $requiresReview ? 'Artwork saved and queued for moderation.' : 'Artwork updated successfully.',
+            'review_reasons' => $requiresReview ? $policy['reasons'] : [],
             'artwork' => [
                 'id' => $artwork->id,
                 'title' => $artwork->title,
@@ -315,6 +366,13 @@ final class StudioArtworksApiController extends Controller
                 ])->values()->all(),
                 'content_type_id' => $primaryCategory?->contentType?->id,
                 'category_id' => $primaryCategory?->id,
+                'primary_category_id' => $primaryCategory?->id,
+                'secondary_category_ids' => $artwork->categories
+                    ->reject(fn ($category): bool => (int) $category->id === (int) ($primaryCategory?->id ?? 0))
+                    ->pluck('id')
+                    ->map(fn ($id): int => (int) $id)
+                    ->values()
+                    ->all(),
                 'tags' => $artwork->tags->map(fn ($t) => ['id' => $t->id, 'name' => $t->name, 'slug' => $t->slug])->values()->all(),
                 'title_source' => $artwork->title_source ?: 'manual',
                 'description_source' => $artwork->description_source ?: 'manual',
@@ -326,6 +384,15 @@ final class StudioArtworksApiController extends Controller
         ]);
     }
 
+    private function ensureValidArtworkDescription(array $validated): void
+    {
+        foreach (ArtworkDescriptionContentValidator::errors($validated['description'] ?? null) as $message) {
+            throw ValidationException::withMessages([
+                'description' => [$message],
+            ]);
+        }
+    }
+
     public function evolutionOptions(Request $request, int $id): JsonResponse
     {
         $artwork = $request->user()->artworks()->findOrFail($id);
@@ -449,8 +516,8 @@ final class StudioArtworksApiController extends Controller
             'artwork_status' => $artwork->artwork_status,
             'created_at' => $artwork->created_at?->toIso8601String(),
             'deleted_at' => $artwork->deleted_at?->toIso8601String(),
-            'category'        => $artwork->categories->first()?->name,
+            'category' => $artwork->resolvedPrimaryCategory()?->name,
-            'category_slug'   => $artwork->categories->first()?->slug,
+            'category_slug' => $artwork->resolvedPrimaryCategory()?->slug,
             'tags' => $artwork->tags->pluck('slug')->values()->all(),
             'views' => (int) ($stats?->views ?? 0),
             'favourites' => (int) ($stats?->favorites ?? 0),
@@ -511,9 +578,9 @@ final class StudioArtworksApiController extends Controller
         }
 
         try {
-            $derivatives  = app(\App\Services\Uploads\UploadDerivativesService::class);
+            $derivatives = app(UploadDerivativesService::class);
-            $storage      = app(\App\Services\Uploads\UploadStorageService::class);
+            $storage = app(UploadStorageService::class);
-            $artworkFiles = app(\App\Repositories\Uploads\ArtworkFileRepository::class);
+            $artworkFiles = app(ArtworkFileRepository::class);
 
             // 1. Store original on disk (preserve extension when possible)
             $originalAsset = $derivatives->storeOriginal($tempPath, $hash);
@@ -526,7 +593,7 @@ final class StudioArtworksApiController extends Controller
             // 2. Generate thumbnails (xs/sm/md/lg/xl)
             $publicAssets = $derivatives->generatePublicDerivatives($tempPath, $hash);
             foreach ($publicAssets as $variant => $asset) {
-                $relativePath = $storage->sectionRelativePath($variant, $hash, $hash . '.webp');
+                $relativePath = $storage->sectionRelativePath($variant, $hash, $hash.'.webp');
                 $artworkFiles->upsert($artwork->id, $variant, $relativePath, 'image/webp', (int) ($asset['size'] ?? 0));
             }
 
@@ -547,7 +614,7 @@ final class StudioArtworksApiController extends Controller
             if ($clientName !== '') {
                 $clientExt = strtolower((string) pathinfo($clientName, PATHINFO_EXTENSION));
                 if ($clientExt === '' && $origExt !== '') {
-                    $clientName .= '.' . $origExt;
+                    $clientName .= '.'.$origExt;
                 }
 
                 $displayFileName = $clientName;
@@ -598,7 +665,8 @@ final class StudioArtworksApiController extends Controller
                 'artwork_id' => $artwork->id,
                 'error' => $e->getMessage(),
             ]);
-            return response()->json(['success' => false, 'error' => 'File processing failed: ' . $e->getMessage()], 500);
+
+            return response()->json(['success' => false, 'error' => 'File processing failed: '.$e->getMessage()], 500);
         }
     }
 
@@ -666,8 +734,8 @@ final class StudioArtworksApiController extends Controller
             return response()->json(['success' => false, 'error' => $e->getMessage()], 429);
         }
 
-        $derivatives = app(\App\Services\Uploads\UploadDerivativesService::class);
+        $derivatives = app(UploadDerivativesService::class);
-        $storage = app(\App\Services\Uploads\UploadStorageService::class);
+        $storage = app(UploadStorageService::class);
         $cleanupLocalPaths = [];
         $cleanupObjectPaths = [];
 
@@ -754,7 +822,7 @@ final class StudioArtworksApiController extends Controller
 
             $allScreenshotDescriptors = [];
             foreach (array_values(array_merge($existingScreenshotDescriptors, $newScreenshotDescriptors)) as $index => $descriptor) {
-                $descriptor['variant'] = 'shot' . ($index + 1);
+                $descriptor['variant'] = 'shot'.($index + 1);
                 $allScreenshotDescriptors[] = $descriptor;
             }
 
@@ -850,7 +918,7 @@ final class StudioArtworksApiController extends Controller
 
             return response()->json([
                 'success' => false,
-                'error' => 'Revision update failed: ' . $exception->getMessage(),
+                'error' => 'Revision update failed: '.$exception->getMessage(),
             ], 500);
         }
     }
@@ -906,7 +974,8 @@ final class StudioArtworksApiController extends Controller
             // Reindex
             try {
                 $this->searchIndexer->update($artwork);
-            } catch (\Throwable) {}
+            } catch (\Throwable) {
+            }
 
             return response()->json([
                 'success' => true,
@@ -916,7 +985,7 @@ final class StudioArtworksApiController extends Controller
         } catch (TooManyRequestsHttpException $e) {
             return response()->json(['success' => false, 'error' => $e->getMessage()], 429);
         } catch (\Throwable $e) {
-            return response()->json(['success' => false, 'error' => 'Restore failed: ' . $e->getMessage()], 500);
+            return response()->json(['success' => false, 'error' => 'Restore failed: '.$e->getMessage()], 500);
         }
     }
 
@@ -926,7 +995,7 @@ final class StudioArtworksApiController extends Controller
      * This is best-effort; failures are logged but never fatal.
      * Configure a CDN purge webhook via ARTWORK_CDN_PURGE_URL if needed.
      */
-    private function purgeCdnCache(\App\Models\Artwork $artwork, string $oldHash): void
+    private function purgeCdnCache(Artwork $artwork, string $oldHash): void
     {
         try {
             $this->cdnPurge->purgeArtworkHashVariants($oldHash, 'webp', ['xs', 'sm', 'md', 'lg', 'xl', 'sq'], [
@@ -1016,7 +1085,7 @@ final class StudioArtworksApiController extends Controller
 
         $candidateExt = strtolower((string) pathinfo($candidate, PATHINFO_EXTENSION));
         if ($candidateExt === '' && $ext !== '') {
-            $candidate .= '.' . ltrim($ext, '.');
+            $candidate .= '.'.ltrim($ext, '.');
         }
 
         return $candidate;
@@ -1058,11 +1127,11 @@ final class StudioArtworksApiController extends Controller
             ->values()
             ->map(function (array $file, int $index) use ($base): array {
                 $path = trim((string) ($file['path'] ?? ''), '/');
-                $url = $base . '/' . $path;
+                $url = $base.'/'.$path;
 
                 return [
-                    'id' => (string) ($file['variant'] ?? ('shot' . ($index + 1))),
+                    'id' => (string) ($file['variant'] ?? ('shot'.($index + 1))),
-                    'label' => 'Screenshot ' . ($index + 1),
+                    'label' => 'Screenshot '.($index + 1),
                     'url' => $url,
                     'thumb_url' => $url,
                     'mime_type' => (string) ($file['mime'] ?? 'image/jpeg'),

app/Http/Controllers/Studio/StudioController.php

@@ -5,26 +5,27 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Studio;
 
 use App\Http\Controllers\Controller;
-use App\Models\Group;
 use App\Models\ContentType;
+use App\Models\Group;
 use App\Services\ArtworkEvolutionService;
 use App\Services\Artworks\ArtworkPublicationService;
 use App\Services\GroupMembershipService;
 use App\Services\GroupService;
+use App\Services\Studio\CreatorStudioActivityService;
 use App\Services\Studio\CreatorStudioAnalyticsService;
 use App\Services\Studio\CreatorStudioAssetService;
 use App\Services\Studio\CreatorStudioCalendarService;
+use App\Services\Studio\CreatorStudioChallengeService;
 use App\Services\Studio\CreatorStudioCommentService;
 use App\Services\Studio\CreatorStudioContentService;
 use App\Services\Studio\CreatorStudioFollowersService;
 use App\Services\Studio\CreatorStudioGrowthService;
-use App\Services\Studio\CreatorStudioActivityService;
 use App\Services\Studio\CreatorStudioInboxService;
 use App\Services\Studio\CreatorStudioOverviewService;
 use App\Services\Studio\CreatorStudioPreferenceService;
-use App\Services\Studio\CreatorStudioChallengeService;
-use App\Services\Studio\CreatorStudioSearchService;
 use App\Services\Studio\CreatorStudioScheduledService;
+use App\Services\Studio\CreatorStudioSearchService;
+use App\Services\Uploads\UploadQueueService;
 use App\Services\Worlds\WorldSubmissionService;
 use App\Support\CoverUrl;
 use Illuminate\Http\RedirectResponse;
@@ -95,7 +96,13 @@ final class StudioController extends Controller
     {
         $provider = $this->content->provider('artworks');
         $prefs = $this->preferences->forUser($request->user());
-        $listing = $this->content->list($request->user(), $request->only(['q', 'sort', 'bucket', 'page', 'per_page', 'content_type', 'category', 'tag']), null, 'artworks');
+        $filters = $request->only(['q', 'sort', 'bucket', 'page', 'per_page', 'content_type', 'category', 'tag']);
+
+        if (! $request->filled('sort')) {
+            $filters['sort'] = 'published_desc';
+        }
+
+        $listing = $this->content->list($request->user(), $filters, null, 'artworks');
         $listing['default_view'] = $prefs['default_content_view'];
 
         return Inertia::render('Studio/StudioArtworks', [
@@ -126,7 +133,7 @@ final class StudioController extends Controller
 
     public function uploadQueue(Request $request): Response
     {
-        $queue = app(\App\Services\Uploads\UploadQueueService::class)->listPayload(
+        $queue = app(UploadQueueService::class)->listPayload(
             $request->user(),
             $request->only(['batch_id', 'status', 'sort'])
         );
@@ -355,7 +362,7 @@ final class StudioController extends Controller
                 'cover_url' => $user->cover_hash && $user->cover_ext ? CoverUrl::forUser($user->cover_hash, $user->cover_ext, time()) : null,
                 'cover_position' => (int) ($user->cover_position ?? 50),
                 'followers' => (int) ($user->statistics?->followers_count ?? 0),
-                'profile_url' => '/@' . strtolower((string) $user->username),
+                'profile_url' => '/@'.strtolower((string) $user->username),
                 'social_links' => $socialLinks,
             ],
             'moduleSummaries' => $this->content->moduleSummaries($user),
@@ -443,13 +450,13 @@ final class StudioController extends Controller
     {
         $user = $request->user();
         $artwork = $user->artworks()
-            ->with(['stats', 'categories.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile'])
+            ->with(['stats', 'categories.contentType', 'primaryCategory.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile'])
             ->findOrFail($id);
 
         $artwork = app(ArtworkPublicationService::class)->publishIfDue($artwork);
-        $artwork->loadMissing(['stats', 'categories.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile']);
+        $artwork->loadMissing(['stats', 'categories.contentType', 'primaryCategory.contentType', 'tags', 'artworkAiAssist', 'group.members', 'primaryAuthor.profile', 'contributors.user.profile']);
 
-        $primaryCategory = $artwork->categories->first();
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
         $availableGroups = app(GroupService::class)->studioOptionsForUser($user);
         $membershipService = app(GroupMembershipService::class);
         $contributorOptionsByGroup = [];
@@ -497,9 +504,17 @@ final class StudioController extends Controller
                 ])->values()->all(),
                 'content_type_id' => $primaryCategory?->contentType?->id,
                 'category_id' => $primaryCategory?->id,
+                'primary_category_id' => $primaryCategory?->id,
                 'parent_category_id' => $primaryCategory?->parent_id ? $primaryCategory->parent_id : $primaryCategory?->id,
                 'sub_category_id' => $primaryCategory?->parent_id ? $primaryCategory->id : null,
-                'categories'      => $artwork->categories->map(fn ($c) => ['id' => $c->id, 'name' => $c->name, 'slug' => $c->slug])->values()->all(),
+                'secondary_category_ids' => $artwork->categories
+                    ->reject(fn ($category): bool => (int) $category->id === (int) ($primaryCategory?->id ?? 0))
+                    ->pluck('id')
+                    ->map(fn ($id): int => (int) $id)
+                    ->values()
+                    ->all(),
+                'max_secondary_categories' => (int) config('categories.max_secondary_categories', 5),
+                'categories' => $artwork->categories->map(fn ($c) => ['id' => $c->id, 'name' => $c->name, 'slug' => $c->slug, 'is_primary' => (int) $c->id === (int) ($primaryCategory?->id ?? 0)])->values()->all(),
                 'tags' => $artwork->tags->map(fn ($t) => ['id' => $t->id, 'name' => $t->name, 'slug' => $t->slug])->values()->all(),
                 'ai_status' => $artwork->ai_status,
                 'title_source' => $artwork->title_source ?: 'manual',
@@ -636,11 +651,11 @@ final class StudioController extends Controller
                     return null;
                 }
 
-                $url = $base . '/' . $path;
+                $url = $base.'/'.$path;
 
                 return [
-                    'id' => (string) ($row->variant ?? ('shot' . ($index + 1))),
+                    'id' => (string) ($row->variant ?? ('shot'.($index + 1))),
-                    'label' => 'Screenshot ' . ($index + 1),
+                    'label' => 'Screenshot '.($index + 1),
                     'url' => $url,
                     'thumb_url' => $url,
                     'mime_type' => (string) ($row->mime ?? 'image/jpeg'),

app/Http/Controllers/Studio/StudioNewsController.php

@@ -5,7 +5,9 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Studio;
 
 use App\Http\Controllers\Controller;
+use App\Models\User;
 use App\Services\News\NewsService;
+use App\Support\AvatarUrl;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -32,7 +34,7 @@ final class StudioNewsController extends Controller
         return Inertia::render('Studio/StudioNewsIndex', [
             'title' => 'Newsroom',
             'description' => 'Plan announcements, publish editorial stories, and connect articles to the rest of Nova.',
-            'listing' => $this->news->studioListing($request->only(['q', 'status', 'type', 'category_id', 'per_page', 'page'])),
+            'listing' => $this->news->studioListing($request->only(['q', 'status', 'type', 'category_id', 'per_page', 'page', 'order', 'direction'])),
             'statusOptions' => $this->news->editorialStatusOptions(),
             'typeOptions' => $this->news->articleTypeOptions(),
             'categoryOptions' => $this->news->categoryOptions(),
@@ -46,6 +48,8 @@ final class StudioNewsController extends Controller
     {
         $this->authorizeNews($request);
 
+        $user = $request->user();
+
         return Inertia::render('Studio/StudioNewsEditor', [
             'title' => 'Create article',
             'description' => 'Draft a new News story with editorial workflow, SEO metadata, and related entity links.',
@@ -56,16 +60,19 @@ final class StudioNewsController extends Controller
             'statusOptions' => $this->news->editorialStatusOptions(),
             'categoryOptions' => $this->news->categoryOptions(),
             'tagOptions' => $this->news->tagOptions(),
-            'newsTagLimit' => 12,
+            'newsTagLimit' => 30,
             'relationTypeOptions' => $this->news->relationTypeOptions(),
             'storeUrl' => route('studio.news.store'),
             'coverUploadUrl' => route('api.studio.news.media.upload'),
             'coverDeleteUrl' => route('api.studio.news.media.destroy'),
+            'bodyMediaUploadUrl' => route('api.studio.news.media.upload'),
+            'bodyMediaDeleteUrl' => route('api.studio.news.media.destroy'),
             'coverCdnBaseUrl' => rtrim((string) config('cdn.files_url', 'https://files.skinbase.org'), '/'),
             'entitySearchUrl' => route('studio.news.entity-search'),
             'categoriesUrl' => route('studio.news.categories'),
             'tagsUrl' => route('studio.news.tags'),
-            'defaultAuthor' => $this->news->searchEntities('user', (string) $request->user()->username)[0] ?? null,
+            'defaultAuthor' => $this->mapDefaultAuthor($user),
+            'defaultPublishedAt' => now()->format('Y-m-d\TH:i'),
         ]);
     }
 
@@ -92,10 +99,12 @@ final class StudioNewsController extends Controller
             'statusOptions' => $this->news->editorialStatusOptions(),
             'categoryOptions' => $this->news->categoryOptions(),
             'tagOptions' => $this->news->tagOptions(),
-            'newsTagLimit' => 12,
+            'newsTagLimit' => 30,
             'relationTypeOptions' => $this->news->relationTypeOptions(),
             'coverUploadUrl' => route('api.studio.news.media.upload'),
             'coverDeleteUrl' => route('api.studio.news.media.destroy'),
+            'bodyMediaUploadUrl' => route('api.studio.news.media.upload'),
+            'bodyMediaDeleteUrl' => route('api.studio.news.media.destroy'),
             'coverCdnBaseUrl' => rtrim((string) config('cdn.files_url', 'https://files.skinbase.org'), '/'),
             'updateUrl' => route('studio.news.update', ['article' => $article->id]),
             'destroyUrl' => route('studio.news.destroy', ['article' => $article->id]),
@@ -250,6 +259,29 @@ final class StudioNewsController extends Controller
         ]);
     }
 
+    private function mapDefaultAuthor(mixed $user): ?array
+    {
+        if (! $user instanceof User) {
+            return null;
+        }
+
+        $user->loadMissing('profile');
+
+        return [
+            'id' => (int) $user->id,
+            'entity_type' => 'user',
+            'entity_label' => 'User',
+            'title' => (string) ($user->name ?: $user->username),
+            'subtitle' => $user->username ? '@' . $user->username : null,
+            'description' => Str::limit(trim((string) ($user->profile?->bio ?? '')), 120),
+            'url' => $user->username ? route('profile.show', ['username' => $user->username]) : null,
+            'image' => null,
+            'avatar' => AvatarUrl::forUser((int) $user->id, $user->profile?->avatar_hash ?? null, 96),
+            'context_label' => 'Profile',
+            'meta' => [],
+        ];
+    }
+
     public function storeCategory(Request $request): RedirectResponse
     {
         $this->authorizeNews($request);
@@ -367,30 +399,51 @@ final class StudioNewsController extends Controller
             'comments_enabled' => ['nullable', 'boolean'],
             'tag_ids' => ['nullable', 'array'],
             'tag_ids.*' => ['integer', 'exists:news_tags,id'],
-            'new_tag_names' => ['nullable', 'array', 'max:12'],
+            'new_tag_names' => ['nullable', 'array', 'max:30'],
             'new_tag_names.*' => ['string', 'max:80'],
             'meta_title' => ['nullable', 'string', 'max:255'],
             'meta_description' => ['nullable', 'string', 'max:300'],
             'meta_keywords' => ['nullable', 'string', 'max:255'],
-            'canonical_url' => ['nullable', 'string', 'max:2048', function (string $attribute, mixed $value, \Closure $fail): void {
-                if ($value === '' || $value === null) {
-                    return;
-                }
-                $isAbsolute = filter_var($value, FILTER_VALIDATE_URL) !== false;
-                $isRelative = str_starts_with($value, '/');
-                if (! $isAbsolute && ! $isRelative) {
-                    $fail('The canonical URL must be a valid URL or a relative path starting with /.');
-                }
-            }],
             'og_title' => ['nullable', 'string', 'max:255'],
             'og_description' => ['nullable', 'string', 'max:300'],
             'og_image' => ['nullable', 'string', 'max:2048'],
             'relations' => ['nullable', 'array', 'max:12'],
             'relations.*.entity_type' => ['required_with:relations', Rule::in(array_column($this->news->relationTypeOptions(), 'value'))],
-            'relations.*.entity_id' => ['required_with:relations', 'integer', 'min:1'],
+            'relations.*.entity_id' => ['nullable', 'integer', 'min:1'],
+            'relations.*.external_url' => ['nullable', 'string', 'max:2048'],
             'relations.*.context_label' => ['nullable', 'string', 'max:120'],
         ]);
 
+        $relationErrors = [];
+
+        foreach ((array) ($validated['relations'] ?? []) as $index => $relation) {
+            $entityType = trim(Str::lower((string) ($relation['entity_type'] ?? '')));
+
+            if ($entityType === NewsService::RELATION_SOURCE) {
+                $externalUrl = $this->normalizeExternalRelationUrl($relation['external_url'] ?? null);
+
+                if ($externalUrl === null) {
+                    $relationErrors["relations.{$index}.external_url"] = 'Source relations need a valid URL.';
+                    continue;
+                }
+
+                $validated['relations'][$index]['entity_id'] = null;
+                $validated['relations'][$index]['external_url'] = $externalUrl;
+
+                continue;
+            }
+
+            if ((int) ($relation['entity_id'] ?? 0) < 1) {
+                $relationErrors["relations.{$index}.entity_id"] = 'Select a related entity.';
+            }
+
+            $validated['relations'][$index]['external_url'] = null;
+        }
+
+        if ($relationErrors !== []) {
+            throw ValidationException::withMessages($relationErrors);
+        }
+
         if (($validated['editorial_status'] ?? null) === NewsArticle::EDITORIAL_STATUS_SCHEDULED && empty($validated['published_at'])) {
             throw ValidationException::withMessages([
                 'published_at' => 'Scheduled articles need a publish date and time.',
@@ -400,6 +453,25 @@ final class StudioNewsController extends Controller
         return $validated;
     }
 
+    private function normalizeExternalRelationUrl(mixed $value): ?string
+    {
+        $url = trim((string) ($value ?? ''));
+
+        if ($url === '') {
+            return null;
+        }
+
+        if (preg_match('/^\[[^\]]+\]\((https?:\/\/[^)]+)\)$/i', $url, $matches) === 1) {
+            $url = trim((string) ($matches[1] ?? ''));
+        }
+
+        if ($url === '' || filter_var($url, FILTER_VALIDATE_URL) === false) {
+            return null;
+        }
+
+        return Str::limit($url, 2048, '');
+    }
+
     private function tagPayload(): array
     {
         return NewsTag::query()

app/Http/Controllers/Studio/StudioNewsMediaApiController.php

@@ -46,6 +46,7 @@ final class StudioNewsMediaApiController extends Controller
                 'size_bytes' => $stored['size_bytes'],
                 'mobile_url' => $stored['mobile_url'],
                 'desktop_url' => $stored['desktop_url'],
+                'large_url' => $stored['large_url'],
                 'srcset' => $stored['srcset'],
             ]);
         } catch (RuntimeException $e) {

app/Http/Controllers/User/ProfileController.php

@@ -25,44 +25,49 @@ use App\Models\GroupReleaseContributor;
 use App\Models\ProfileComment;
 use App\Models\Story;
 use App\Models\User;
-use Carbon\CarbonInterface;
-use App\Services\Security\CaptchaVerifier;
-use App\Services\AvatarService;
-use App\Services\ArtworkService;
-use App\Services\FollowService;
 use App\Services\AchievementService;
+use App\Services\ArtworkService;
+use App\Services\AvatarService;
 use App\Services\CollectionService;
-use App\Services\FollowAnalyticsService;
-use App\Services\LeaderboardService;
-use App\Services\UserSuggestionService;
 use App\Services\Countries\CountryCatalogService;
+use App\Services\FollowAnalyticsService;
+use App\Services\FollowService;
+use App\Services\LeaderboardService;
 use App\Services\Maturity\ArtworkMaturityService;
-use App\Services\ThumbnailPresenter;
-use App\Services\Worlds\WorldRewardService;
-use App\Services\XPService;
-use App\Services\UsernameApprovalService;
 use App\Services\Profile\CreatorJourneyService;
 use App\Services\Profile\WorldProfileHistoryService;
+use App\Services\Security\CaptchaVerifier;
+use App\Services\ThumbnailPresenter;
+use App\Services\UsernameApprovalService;
 use App\Services\UserStatsService;
+use App\Services\UserSuggestionService;
+use App\Services\Worlds\WorldRewardService;
+use App\Services\XPService;
 use App\Support\AvatarUrl;
 use App\Support\CoverUrl;
 use App\Support\Seo\SeoFactory;
 use App\Support\UsernamePolicy;
+use Carbon\Carbon;
+use Carbon\CarbonInterface;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Redirect;
-use Illuminate\Support\Facades\Schema;
-use Illuminate\View\View;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Redirect;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Validation\Rules\Password as PasswordRule;
+use Illuminate\View\View;
 use Inertia\Inertia;
 
 class ProfileController extends Controller
 {
+    private const SSR_WORLD_HISTORY_TABS = ['achievements', 'worlds'];
+
     private const PROFILE_TABS = [
         'posts',
         'artworks',
@@ -74,6 +79,7 @@ class ProfileController extends Controller
         'stats',
         'favourites',
         'activity',
+        'followers',
     ];
 
     public function __construct(
@@ -92,9 +98,7 @@ class ProfileController extends Controller
         private readonly CreatorJourneyService $creatorJourney,
         private readonly WorldRewardService $worldRewards,
         private readonly WorldProfileHistoryService $worldProfileHistory,
-    )
+    ) {}
-    {
-    }
 
     public function showByUsername(Request $request, string $username)
     {
@@ -188,6 +192,44 @@ class ProfileController extends Controller
         return $this->renderProfilePage($request, $user, 'Profile/ProfileShow', false, $normalizedTab);
     }
 
+    /**
+     * Read-only featured artwork payload for the client-side Artworks tab.
+     * This deliberately does not render the profile document or track a view.
+     */
+    public function featuredArtworks(Request $request, string $username): JsonResponse
+    {
+        $normalized = UsernamePolicy::normalize($username);
+        $user = User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
+
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        return response()->json([
+            'data' => $this->loadFeaturedArtworks($user, $request->user())->values(),
+        ]);
+    }
+
+    /**
+     * Read-only world history payload for profile tabs that are loaded client-side.
+     * This deliberately does not render the profile document or track a view.
+     */
+    public function worldHistory(Request $request, string $username): JsonResponse
+    {
+        $normalized = UsernamePolicy::normalize($username);
+        $user = User::query()->whereRaw('LOWER(username) = ?', [$normalized])->first();
+
+        if (! $user) {
+            return response()->json(['error' => 'User not found'], 404);
+        }
+
+        $isOwner = Auth::check() && Auth::id() === $user->id;
+
+        return response()->json($isOwner
+            ? $this->worldProfileHistory->ownerPayloadForUser($user)
+            : $this->worldProfileHistory->publicPayloadForUser($user));
+    }
+
     public function legacyById(Request $request, int $id, ?string $username = null)
     {
         $user = User::query()->findOrFail($id);
@@ -200,6 +242,28 @@ class ProfileController extends Controller
         return redirect()->route('profile.show', ['username' => UsernamePolicy::normalize($username)], 301);
     }
 
+    /**
+     * Legacy "All followers" URL from old profile templates:
+     * GET /following/{id}/{slug?} → /@{canonical-username}/followers
+     */
+    public function legacyFollowingById(Request $request, int $id, ?string $slug = null)
+    {
+        $user = User::query()->find($id);
+
+        if (! $user) {
+            abort(404);
+        }
+
+        $url = url('/@'.strtolower((string) $user->username).'/followers');
+        $query = $request->query();
+
+        if ($query !== []) {
+            $url .= '?'.http_build_query($query);
+        }
+
+        return redirect()->to($url, 301);
+    }
+
     /** Toggle follow/unfollow for the profile of $username (auth required). */
     public function toggleFollow(Request $request, string $username): JsonResponse
     {
@@ -284,27 +348,49 @@ class ProfileController extends Controller
                 $profile = DB::table('user_profiles')->where('user_id', $user->id)->first();
                 if ($profile) {
                     $profileData = (array) $profile;
-                    if (isset($profile->website)) $user->homepage = $profile->website;
+                    if (isset($profile->website)) {
-                    if (isset($profile->about)) $user->about_me = $profile->about;
+                        $user->homepage = $profile->website;
-                    if (isset($profile->birthdate)) $user->birth = $profile->birthdate;
+                    }
-                    if (isset($profile->gender)) $user->gender = $profile->gender;
+                    if (isset($profile->about)) {
-                    if (isset($profile->country_code)) $user->country_code = $profile->country_code;
+                        $user->about_me = $profile->about;
-                    if (isset($profile->signature)) $user->signature = $profile->signature;
+                    }
-                    if (isset($profile->description)) $user->description = $profile->description;
+                    if (isset($profile->birthdate)) {
-                    if (isset($profile->mlist)) $user->mlist = $profile->mlist;
+                        $user->birth = $profile->birthdate;
-                    if (isset($profile->friend_upload_notice)) $user->friend_upload_notice = $profile->friend_upload_notice;
+                    }
-                    if (isset($profile->auto_post_upload)) $user->auto_post_upload = $profile->auto_post_upload;
+                    if (isset($profile->gender)) {
+                        $user->gender = $profile->gender;
+                    }
+                    if (isset($profile->country_code)) {
+                        $user->country_code = $profile->country_code;
+                    }
+                    if (isset($profile->signature)) {
+                        $user->signature = $profile->signature;
+                    }
+                    if (isset($profile->description)) {
+                        $user->description = $profile->description;
+                    }
+                    if (isset($profile->mlist)) {
+                        $user->mlist = $profile->mlist;
+                    }
+                    if (isset($profile->friend_upload_notice)) {
+                        $user->friend_upload_notice = $profile->friend_upload_notice;
+                    }
+                    if (isset($profile->auto_post_upload)) {
+                        $user->auto_post_upload = $profile->auto_post_upload;
                     }
                 }
-        } catch (\Throwable $e) {}
+            }
+        } catch (\Throwable $e) {
+        }
 
-        if (!empty($user->birth)) {
+        if (! empty($user->birth)) {
             try {
-                $dt = \Carbon\Carbon::parse($user->birth);
+                $dt = Carbon::parse($user->birth);
                 $birthDay = $dt->format('d');
                 $birthMonth = $dt->format('m');
                 $birthYear = $dt->format('Y');
-            } catch (\Throwable $e) {}
+            } catch (\Throwable $e) {
+            }
         }
 
         $selectedCountry = $this->countryCatalog->resolveUserCountry($user);
@@ -312,7 +398,7 @@ class ProfileController extends Controller
 
         // Avatar URL
         $avatarHash = $profileData['avatar_hash'] ?? $user->icon ?? null;
-        $avatarUrl = !empty($avatarHash)
+        $avatarUrl = ! empty($avatarHash)
             ? AvatarUrl::forUser((int) $user->id, $avatarHash, 256)
             : AvatarUrl::default();
 
@@ -386,7 +472,7 @@ class ProfileController extends Controller
 
         $avatarUrl = AvatarUrl::forUser((int) $user->id, null, 256);
 
-        if (!empty($validated['remove_avatar'])) {
+        if (! empty($validated['remove_avatar'])) {
             $avatarService->removeAvatar((int) $user->id);
             $avatarUrl = AvatarUrl::default();
         }
@@ -568,8 +654,8 @@ class ProfileController extends Controller
             'country_code' => $selectedCountry?->iso2,
         ];
 
-        if (!empty($validated['gender'])) {
+        if (array_key_exists('gender', $validated)) {
-            $profileUpdates['gender'] = strtoupper((string) $validated['gender']);
+            $profileUpdates['gender'] = $this->normalizeProfileGender($validated['gender'] ?? null);
         }
 
         $this->persistProfileUpdates((int) $request->user()->id, $profileUpdates);
@@ -635,7 +721,7 @@ class ProfileController extends Controller
 
     private function persistProfileUpdates(int $userId, array $updates): void
     {
-        if ($updates === [] || !Schema::hasTable('user_profiles')) {
+        if ($updates === [] || ! Schema::hasTable('user_profiles')) {
             return;
         }
 
@@ -653,6 +739,29 @@ class ProfileController extends Controller
         DB::table('user_profiles')->updateOrInsert(['user_id' => $userId], $filtered);
     }
 
+    /**
+     * Normalize gender to the MySQL enum values used by user_profiles.gender.
+     */
+    private function normalizeProfileGender(mixed $value): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        $normalized = strtolower(trim((string) $value));
+
+        if ($normalized === '') {
+            return null;
+        }
+
+        return match ($normalized) {
+            'm', 'male', 'man', 'boy' => 'M',
+            'f', 'female', 'woman', 'girl' => 'F',
+            'x', 'n', 'na', 'n/a', 'nonbinary', 'non-binary', 'prefer_not_to_say', 'prefer not to say' => 'X',
+            default => null,
+        };
+    }
+
     private function resolveCountrySelection(int|string|null $countryId = null, ?string $countryCode = null): ?Country
     {
         if (is_numeric($countryId) && (int) $countryId > 0) {
@@ -736,7 +845,7 @@ class ProfileController extends Controller
         );
     }
 
-    public function update(ProfileUpdateRequest $request, \App\Services\AvatarService $avatarService): RedirectResponse|JsonResponse
+    public function update(ProfileUpdateRequest $request, AvatarService $avatarService): RedirectResponse|JsonResponse
     {
         $user = $request->user();
 
@@ -763,6 +872,7 @@ class ProfileController extends Controller
                     if ($request->expectsJson()) {
                         return response()->json(['errors' => $error], 422);
                     }
+
                     return Redirect::back()->withErrors($error);
                 }
 
@@ -775,6 +885,7 @@ class ProfileController extends Controller
                     if ($request->expectsJson()) {
                         return response()->json(['errors' => $error], 422);
                     }
+
                     return Redirect::back()->withErrors($error);
                 }
 
@@ -789,7 +900,7 @@ class ProfileController extends Controller
             }
         }
 
-        if (!empty($validated['email']) && empty($user->email)) {
+        if (! empty($validated['email']) && empty($user->email)) {
             $user->email = $validated['email'];
             $user->email_verified_at = null;
         }
@@ -797,11 +908,13 @@ class ProfileController extends Controller
         $user->save();
 
         $profileUpdates = [];
-        if (!empty($validated['about'])) $profileUpdates['about'] = $validated['about'];
+        if (! empty($validated['about'])) {
+            $profileUpdates['about'] = $validated['about'];
+        }
 
-        if (!empty($validated['web'])) {
+        if (! empty($validated['web'])) {
             $profileUpdates['website'] = $validated['web'];
-        } elseif (!empty($validated['homepage'])) {
+        } elseif (! empty($validated['homepage'])) {
             $profileUpdates['website'] = $validated['homepage'];
         }
 
@@ -809,13 +922,11 @@ class ProfileController extends Controller
         $month = $validated['month'] ?? null;
         $year = $validated['year'] ?? null;
         if ($year && $month && $day) {
-            $profileUpdates['birthdate'] = sprintf('%04d-%02d-%02d', (int)$year, (int)$month, (int)$day);
+            $profileUpdates['birthdate'] = sprintf('%04d-%02d-%02d', (int) $year, (int) $month, (int) $day);
         }
 
-        if (!empty($validated['gender'])) {
+        if (array_key_exists('gender', $validated)) {
-            $g = strtolower($validated['gender']);
+            $profileUpdates['gender'] = $this->normalizeProfileGender($validated['gender'] ?? null);
-            $map = ['m' => 'M', 'f' => 'F', 'n' => 'X', 'x' => 'X'];
-            $profileUpdates['gender'] = $map[$g] ?? strtoupper($validated['gender']);
         }
 
         if (array_key_exists('country_id', $validated) || array_key_exists('country', $validated)) {
@@ -839,52 +950,69 @@ class ProfileController extends Controller
             $profileUpdates['auto_post_upload'] = filter_var($validated['auto_post_upload'], FILTER_VALIDATE_BOOLEAN) ? 1 : 0;
         }
 
-        if (isset($validated['signature'])) $profileUpdates['signature'] = $validated['signature'];
+        if (isset($validated['signature'])) {
-        if (isset($validated['description'])) $profileUpdates['description'] = $validated['description'];
+            $profileUpdates['signature'] = $validated['signature'];
+        }
+        if (isset($validated['description'])) {
+            $profileUpdates['description'] = $validated['description'];
+        }
 
-        if (isset($validated['about'])) $profileUpdates['about'] = $validated['about'];
+        if (isset($validated['about'])) {
+            $profileUpdates['about'] = $validated['about'];
+        }
 
         if ($request->hasFile('avatar')) {
             try {
                 $avatarService->storeFromUploadedFile($user->id, $request->file('avatar'));
             } catch (\Exception $e) {
                 if ($request->expectsJson()) {
-                    return response()->json(['errors' => ['avatar' => ['Avatar processing failed: ' . $e->getMessage()]]], 422);
+                    return response()->json(['errors' => ['avatar' => ['Avatar processing failed: '.$e->getMessage()]]], 422);
                 }
-                return Redirect::back()->with('error', 'Avatar processing failed: ' . $e->getMessage());
+
+                return Redirect::back()->with('error', 'Avatar processing failed: '.$e->getMessage());
             }
         }
 
+        $allowedImageMimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+
         if ($request->hasFile('emoticon')) {
             $file = $request->file('emoticon');
-            $fname = $file->getClientOriginalName();
+            if (in_array($file->getMimeType(), $allowedImageMimes, true)) {
-            $path = \Illuminate\Support\Facades\Storage::disk('public')->putFileAs('user-emoticons/'.$user->id, $file, $fname);
+                $ext = $file->guessExtension() ?: 'jpg';
+                $fname = $user->id.'_emoticon_'.time().'.'.$ext;
+                Storage::disk('public')->putFileAs('user-emoticons/'.$user->id, $file, $fname);
                 try {
-                \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update(['eicon' => $fname]);
+                    DB::table('users')->where('id', $user->id)->update(['eicon' => $fname]);
-            } catch (\Exception $e) {}
+                } catch (\Exception $e) {
+                }
+            }
         }
 
         if ($request->hasFile('photo')) {
             $file = $request->file('photo');
-            $fname = $file->getClientOriginalName();
+            if (in_array($file->getMimeType(), $allowedImageMimes, true)) {
-            $path = \Illuminate\Support\Facades\Storage::disk('public')->putFileAs('user-picture/'.$user->id, $file, $fname);
+                $ext = $file->guessExtension() ?: 'jpg';
-            if (\Illuminate\Support\Facades\Schema::hasTable('user_profiles')) {
+                $fname = $user->id.'_photo_'.time().'.'.$ext;
+                Storage::disk('public')->putFileAs('user-picture/'.$user->id, $file, $fname);
+                if (Schema::hasTable('user_profiles')) {
                     $profileUpdates['cover_image'] = $fname;
                 } else {
                     try {
-                    \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update(['picture' => $fname]);
+                        DB::table('users')->where('id', $user->id)->update(['picture' => $fname]);
-                } catch (\Exception $e) {}
+                    } catch (\Exception $e) {
+                    }
+                }
             }
         }
 
         try {
-            if (\Illuminate\Support\Facades\Schema::hasTable('user_profiles')) {
+            if (Schema::hasTable('user_profiles')) {
-                if (!empty($profileUpdates)) {
+                if (! empty($profileUpdates)) {
-                    \Illuminate\Support\Facades\DB::table('user_profiles')->updateOrInsert(['user_id' => $user->id], $profileUpdates);
+                    DB::table('user_profiles')->updateOrInsert(['user_id' => $user->id], $profileUpdates);
                 }
             } else {
-                if (!empty($profileUpdates)) {
+                if (! empty($profileUpdates)) {
-                    \Illuminate\Support\Facades\DB::table('users')->where('id', $user->id)->update($profileUpdates);
+                    DB::table('users')->where('id', $user->id)->update($profileUpdates);
                 }
             }
         } catch (\Exception $e) {
@@ -945,8 +1073,7 @@ class ProfileController extends Controller
         string $component = 'Profile/ProfileShow',
         bool $galleryOnly = false,
         ?string $initialTab = null,
-    )
+    ) {
-    {
         $isOwner = Auth::check() && Auth::id() === $user->id;
         $viewer = Auth::user();
         $perPage = 24;
@@ -958,52 +1085,22 @@ class ProfileController extends Controller
             });
 
         // ── Featured artworks for this user ─────────────────────────────────
-        $featuredArtworks = collect();
+        $featuredArtworks = $initialTab === 'artworks'
-        if (Schema::hasTable('artwork_features')) {
+            ? $this->loadFeaturedArtworks($user, $viewer)
-            $featuredQuery = Artwork::query()
+            : null;
-                ->with([
-                    'user:id,name,username,level,rank',
-                    'user.profile:user_id,avatar_hash',
-                    'group:id,name,slug,avatar_path',
-                    'stats:artwork_id,views,downloads,favorites',
-                    'categories' => function ($query) {
-                        $query->select('categories.id', 'categories.content_type_id', 'categories.parent_id', 'categories.name', 'categories.slug', 'categories.sort_order')
-                            ->with(['parent:id,parent_id,content_type_id,name,slug', 'contentType:id,slug,name']);
-                    },
-                ])
-                ->join('artwork_features as af', 'af.artwork_id', '=', 'artworks.id')
-                ->where('artworks.user_id', $user->id)
-                ->where('af.is_active', true)
-                ->whereNull('af.deleted_at')
-                ->whereNull('artworks.deleted_at')
-                ->where('artworks.is_public', true)
-                ->where('artworks.is_approved', true)
-                ->whereNotNull('artworks.published_at')
-                ->select(['artworks.*', 'af.label as featured_label', 'af.featured_at as featured_slot_at'])
-                ->orderByDesc('af.featured_at')
-                ->limit(3);
 
-            app(ArtworkMaturityService::class)->applyViewerFilter($featuredQuery, $viewer);
+        // ── Favourites (only needed for the direct Favourites tab) ───────────
-
+        $favourites = null;
-            $featuredArtworks = $featuredQuery
+        if ($initialTab === 'favourites') {
-                ->get()
-                ->map(function (Artwork $artwork) {
-                    return (object) array_merge($this->mapArtworkCardPayload($artwork), [
-                        'label' => $artwork->featured_label,
-                        'featured_at' => $this->formatIsoDate($artwork->featured_slot_at),
-                    ]);
-                });
-        }
-
-        // ── Favourites ───────────────────────────────────────────────────────
             $favouriteLimit = 12;
             $favouriteTable = $this->resolveFavouriteTable();
             $favourites = [
                 'data' => [],
                 'next_cursor' => null,
             ];
-        if ($favouriteTable !== null) {
+        }
-            $favIds = DB::table($favouriteTable . ' as af')
+        if ($favourites !== null && $favouriteTable !== null) {
+            $favIds = DB::table($favouriteTable.' as af')
                 ->join('artworks as a', 'a.id', '=', 'af.artwork_id')
                 ->where('af.user_id', $user->id)
                 ->whereNull('a.deleted_at')
@@ -1087,7 +1184,7 @@ class ProfileController extends Controller
                     'username' => $row->username,
                     'uname' => $row->username ?? $row->name,
                     'avatar_url' => AvatarUrl::forUser((int) $row->id, $row->avatar_hash, 50),
-                    'profile_url' => '/@' . strtolower((string) ($row->username ?? $row->id)),
+                    'profile_url' => '/@'.strtolower((string) ($row->username ?? $row->id)),
                     'followed_at' => $row->followed_at,
                 ]);
 
@@ -1169,7 +1266,7 @@ class ProfileController extends Controller
                     'author_name' => $row->author_username ?? $row->author_name ?? 'Unknown',
                     'author_level' => (int) ($row->author_level ?? 1),
                     'author_rank' => (string) ($row->author_rank ?? 'Newbie'),
-                    'author_profile_url' => '/@' . strtolower((string) ($row->author_username ?? $row->author_id)),
+                    'author_profile_url' => '/@'.strtolower((string) ($row->author_username ?? $row->author_id)),
                     'author_avatar' => AvatarUrl::forUser((int) $row->author_id, $row->author_avatar_hash, 50),
                     'author_signature' => $row->author_signature,
                 ]);
@@ -1215,8 +1312,11 @@ class ProfileController extends Controller
                 'published_at' => $story->published_at?->toISOString(),
             ]);
 
+        $profileCollectionsPayload = null;
+        if ($initialTab === 'collections') {
             $profileCollections = $this->collections->getProfileCollections($user, $viewer);
             $profileCollectionsPayload = $this->collections->mapCollectionCardPayloads($profileCollections, $isOwner, $viewer);
+        }
 
         // ── Profile data ─────────────────────────────────────────────────────
         $profile = $user->profile;
@@ -1235,7 +1335,8 @@ class ProfileController extends Controller
         if (! $isOwner) {
             try {
                 $this->userStats->incrementProfileViews($user->id);
-            } catch (\Throwable) {}
+            } catch (\Throwable) {
+            }
         }
 
         // ── Normalise artworks for JSON serialisation ────────────────────
@@ -1252,7 +1353,7 @@ class ProfileController extends Controller
         // ── Auth context for JS ───────────────────────────────────────────
         $authData = null;
         if (Auth::check()) {
-            /** @var \App\Models\User $authUser */
+            /** @var User $authUser */
             $authUser = Auth::user();
             $authAvatarUrl = AvatarUrl::forUser((int) $authUser->id, $authUser->profile?->avatar_hash, 64);
             $authData = [
@@ -1266,16 +1367,18 @@ class ProfileController extends Controller
         }
 
         $usernameSlug = strtolower((string) ($user->username ?? ''));
-        $canonical = url('/@' . $usernameSlug);
+        $canonical = url('/@'.$usernameSlug);
-        $galleryUrl = url('/@' . $usernameSlug . '/gallery');
+        $galleryUrl = url('/@'.$usernameSlug.'/gallery');
         $profileTabUrls = collect(self::PROFILE_TABS)
-            ->mapWithKeys(fn (string $tab) => [$tab => url('/@' . $usernameSlug . '/' . $tab)])
+            ->mapWithKeys(fn (string $tab) => [$tab => url('/@'.$usernameSlug.'/'.$tab)])
             ->all();
         $achievementSummary = $this->achievements->summary((int) $user->id);
         $worldRewardSummary = $this->worldRewards->summaryForUser($user);
-        $worldHistory = $isOwner
+        $worldHistory = in_array($initialTab, self::SSR_WORLD_HISTORY_TABS, true)
+            ? ($isOwner
                 ? $this->worldProfileHistory->ownerPayloadForUser($user)
-            : $this->worldProfileHistory->publicPayloadForUser($user);
+                : $this->worldProfileHistory->publicPayloadForUser($user))
+            : null;
         $leaderboardRank = $this->leaderboards->creatorRankSummary((int) $user->id);
         $groupContributionHistory = $this->buildGroupContributionHistory($user);
         $journey = $this->creatorJourney->publicPayloadForUser($user);
@@ -1285,19 +1388,49 @@ class ProfileController extends Controller
             ? ($profileTabUrls[$resolvedInitialTab] ?? $canonical)
             : $canonical;
         $tabMetaLabel = $resolvedInitialTab !== null
-            ? ucfirst($resolvedInitialTab)
+            ? ($resolvedInitialTab === 'followers' ? 'Followers' : ucfirst($resolvedInitialTab))
             : null;
 
+        $followersListing = null;
+
+        if (! $galleryOnly && $resolvedInitialTab === 'followers') {
+            $followersPage = max(1, (int) $request->query('page', 1));
+            $followersListing = [
+                'data' => [],
+                'current_page' => $followersPage,
+                'last_page' => 1,
+                'per_page' => 24,
+                'total' => 0,
+                'next_page_url' => null,
+                'prev_page_url' => null,
+            ];
+
+            if (Schema::hasTable('user_followers')) {
+                $followersPaginator = $this->followService->paginatedFollowers((int) $user->id, 24, $followersPage);
+                $followersListing = [
+                    'data' => array_values($followersPaginator->items()),
+                    'current_page' => $followersPaginator->currentPage(),
+                    'last_page' => $followersPaginator->lastPage(),
+                    'per_page' => $followersPaginator->perPage(),
+                    'total' => $followersPaginator->total(),
+                    'next_page_url' => $followersPaginator->nextPageUrl(),
+                    'prev_page_url' => $followersPaginator->previousPageUrl(),
+                ];
+            }
+        }
+
         $pageTitle = $galleryOnly
-            ? (($user->username ?? $user->name ?? 'User') . ' Gallery on Skinbase')
+            ? (($user->username ?? $user->name ?? 'User').' Gallery on Skinbase')
             : ($isTabLanding
-                ? (($user->username ?? $user->name ?? 'User') . ' ' . $tabMetaLabel . ' on Skinbase')
+                ? (($user->username ?? $user->name ?? 'User').' '.$tabMetaLabel.' on Skinbase')
-                : (($user->username ?? $user->name ?? 'User') . ' on Skinbase'));
+                : (($user->username ?? $user->name ?? 'User').' on Skinbase'));
         $pageDescription = $galleryOnly
-            ? ('Browse the public gallery of ' . ($user->username ?? $user->name) . ' on Skinbase.')
+            ? ('Browse the public gallery of '.($user->username ?? $user->name).' on Skinbase.')
+            : ($resolvedInitialTab === 'followers'
+                ? ('People who follow '.($user->username ?? $user->name).' on Skinbase.')
                 : ($isTabLanding
-                ? ('Explore the ' . strtolower((string) $tabMetaLabel) . ' section for ' . ($user->username ?? $user->name) . ' on Skinbase.')
+                    ? ('Explore the '.strtolower((string) $tabMetaLabel).' section for '.($user->username ?? $user->name).' on Skinbase.')
-                : ('View the profile of ' . ($user->username ?? $user->name) . ' on Skinbase — artworks, favourites and more.'));
+                    : ('View the profile of '.($user->username ?? $user->name).' on Skinbase — artworks, favourites and more.')));
         $profileSeo = app(SeoFactory::class)->profilePage(
             $pageTitle,
             $galleryOnly ? $galleryUrl : $activeProfileUrl,
@@ -1316,7 +1449,7 @@ class ProfileController extends Controller
                 'name' => $user->name,
                 'avatar_url' => $avatarUrl,
                 'cover_url' => $heroBgUrl,
-                'cover_position'=> (int) ($user->cover_position ?? 50),
+                'cover_position' => (int) ($user->cover_position ?? 50),
                 'created_at' => $user->created_at?->toISOString(),
                 'last_visit_at' => $user->last_visit_at ? (string) $user->last_visit_at : null,
                 'xp' => $xpSummary['xp'],
@@ -1336,12 +1469,13 @@ class ProfileController extends Controller
                 'cover_image' => $profile->cover_image ?? null,
             ] : null,
             'artworks' => $artworkPayload,
-            'featuredArtworks'  => $featuredArtworks->values(),
+            'featuredArtworks' => $featuredArtworks?->values(),
             'favourites' => $favourites,
             'stats' => $statsPayload,
             'socialLinks' => $socialLinks,
             'followerCount' => $followerCount,
             'recentFollowers' => $recentFollowers->values(),
+            'followersListing' => $followersListing,
             'followContext' => $followContext,
             'followAnalytics' => $followAnalytics,
             'suggestedUsers' => $suggestedUsers,
@@ -1378,6 +1512,50 @@ class ProfileController extends Controller
         ]);
     }
 
+    /**
+     * Build the canonical featured artwork representation shared by SSR and
+     * the lazy Artworks-tab endpoint.
+     */
+    private function loadFeaturedArtworks(User $user, ?User $viewer): ?Collection
+    {
+        if (! Schema::hasTable('artwork_features')) {
+            return collect();
+        }
+
+        $featuredQuery = Artwork::query()
+            ->with([
+                'user:id,name,username,level,rank',
+                'user.profile:user_id,avatar_hash',
+                'group:id,name,slug,avatar_path',
+                'stats:artwork_id,views,downloads,favorites',
+                'categories' => function ($query) {
+                    $query->select('categories.id', 'categories.content_type_id', 'categories.parent_id', 'categories.name', 'categories.slug', 'categories.sort_order')
+                        ->with(['parent:id,parent_id,content_type_id,name,slug', 'contentType:id,slug,name']);
+                },
+            ])
+            ->join('artwork_features as af', 'af.artwork_id', '=', 'artworks.id')
+            ->where('artworks.user_id', $user->id)
+            ->where('af.is_active', true)
+            ->whereNull('af.deleted_at')
+            ->whereNull('artworks.deleted_at')
+            ->where('artworks.is_public', true)
+            ->where('artworks.is_approved', true)
+            ->whereNotNull('artworks.published_at')
+            ->select(['artworks.*', 'af.label as featured_label', 'af.featured_at as featured_slot_at'])
+            ->orderByDesc('af.featured_at')
+            ->limit(3);
+
+        app(ArtworkMaturityService::class)->applyViewerFilter($featuredQuery, $viewer);
+
+        return $featuredQuery->get()
+            ->map(function (Artwork $artwork) {
+                return (object) array_merge($this->mapArtworkCardPayload($artwork), [
+                    'label' => $artwork->featured_label,
+                    'featured_at' => $this->formatIsoDate($artwork->featured_slot_at),
+                ]);
+            });
+    }
+
     private function normalizeProfileTab(mixed $tab): ?string
     {
         if (! is_string($tab)) {
@@ -1391,13 +1569,13 @@ class ProfileController extends Controller
 
     private function redirectToProfileTab(Request $request, string $username, string $tab): RedirectResponse
     {
-        $baseUrl = url('/@' . strtolower($username) . '/' . $tab);
+        $baseUrl = url('/@'.strtolower($username).'/'.$tab);
 
         $query = $request->query();
         unset($query['tab']);
 
         if ($query !== []) {
-            $baseUrl .= '?' . http_build_query($query);
+            $baseUrl .= '?'.http_build_query($query);
         }
 
         return redirect()->to($baseUrl, 301);
@@ -1405,7 +1583,7 @@ class ProfileController extends Controller
 
     private function buildGroupContributionHistory(User $user): array
     {
-        return GroupContributorStat::query()
+        $stats = GroupContributorStat::query()
             ->with(['group.owner.profile'])
             ->where('user_id', $user->id)
             ->whereHas('group', fn ($query) => $query
@@ -1414,29 +1592,60 @@ class ProfileController extends Controller
             ->orderByDesc('release_count')
             ->orderByDesc('credited_artworks_count')
             ->limit(8)
+            ->get();
+
+        $groupIds = $stats->pluck('group_id')->map(static fn ($id): int => (int) $id)->values()->all();
+        if ($groupIds === []) {
+            return [];
+        }
+
+        $membershipsByGroup = GroupMember::query()
+            ->whereIn('group_id', $groupIds)
+            ->where('user_id', $user->id)
+            ->where('status', Group::STATUS_ACTIVE)
             ->get()
-            ->map(function (GroupContributorStat $stat) use ($user): ?array {
+            ->keyBy('group_id');
+
+        $releaseRolesByGroup = GroupReleaseContributor::query()
+            ->join('group_releases as bulk_releases', 'bulk_releases.id', '=', 'group_release_contributors.group_release_id')
+            ->where('group_release_contributors.user_id', $user->id)
+            ->whereIn('bulk_releases.group_id', $groupIds)
+            ->whereNull('bulk_releases.deleted_at')
+            ->orderBy('group_release_contributors.id')
+            ->get([
+                'bulk_releases.group_id',
+                'group_release_contributors.role_label',
+            ])
+            ->groupBy('group_id');
+
+        $projectRolesByGroup = GroupProjectMember::query()
+            ->join('group_projects as bulk_projects', 'bulk_projects.id', '=', 'group_project_members.group_project_id')
+            ->where('group_project_members.user_id', $user->id)
+            ->whereIn('bulk_projects.group_id', $groupIds)
+            ->whereNull('bulk_projects.deleted_at')
+            ->orderBy('group_project_members.id')
+            ->get([
+                'bulk_projects.group_id',
+                'group_project_members.role_label',
+            ])
+            ->groupBy('group_id');
+
+        $recentReleasesByGroup = $this->loadRecentGroupReleaseTitles($user, $groupIds);
+
+        return $stats
+            ->map(function (GroupContributorStat $stat) use ($user, $membershipsByGroup, $releaseRolesByGroup, $projectRolesByGroup, $recentReleasesByGroup): ?array {
                 $group = $stat->group;
 
                 if (! $group) {
                     return null;
                 }
 
-                $member = GroupMember::query()
+                $groupId = (int) $group->id;
-                    ->where('group_id', $group->id)
+                $member = $membershipsByGroup->get($groupId);
-                    ->where('user_id', $user->id)
-                    ->where('status', Group::STATUS_ACTIVE)
-                    ->first();
 
                 $roleLabels = collect()
-                    ->merge(GroupReleaseContributor::query()
+                    ->merge($releaseRolesByGroup->get($groupId, collect())->pluck('role_label'))
-                        ->where('user_id', $user->id)
+                    ->merge($projectRolesByGroup->get($groupId, collect())->pluck('role_label'))
-                        ->whereHas('release', fn ($query) => $query->where('group_id', $group->id))
-                        ->pluck('role_label'))
-                    ->merge(GroupProjectMember::query()
-                        ->where('user_id', $user->id)
-                        ->whereHas('project', fn ($query) => $query->where('group_id', $group->id))
-                        ->pluck('role_label'))
                     ->filter()
                     ->map(fn ($label): string => trim((string) $label))
                     ->filter()
@@ -1444,21 +1653,7 @@ class ProfileController extends Controller
                     ->values()
                     ->all();
 
-                $recentReleaseTitles = GroupRelease::query()
+                $recentReleaseTitles = $recentReleasesByGroup->get($groupId, collect())->all();
-                    ->where('group_id', $group->id)
-                    ->where('visibility', GroupRelease::VISIBILITY_PUBLIC)
-                    ->where(function ($query) use ($user): void {
-                        $query->where('lead_user_id', $user->id)
-                            ->orWhere('created_by_user_id', $user->id)
-                            ->orWhereHas('contributorLinks', fn ($contributorQuery) => $contributorQuery->where('user_id', $user->id));
-                    })
-                    ->orderByDesc('released_at')
-                    ->latest('updated_at')
-                    ->limit(3)
-                    ->pluck('title')
-                    ->map(fn ($title): string => (string) $title)
-                    ->values()
-                    ->all();
 
                 $joinedAt = $group->isOwnedBy($user)
                     ? $group->created_at?->toISOString()
@@ -1495,6 +1690,45 @@ class ProfileController extends Controller
             ->all();
     }
 
+    /**
+     * Load the same top-three public releases per group as the previous
+     * per-group LIMIT query, while keeping the existing two-column ordering.
+     *
+     * @param  array<int, int>  $groupIds
+     * @return Collection<int, Collection<int, string>>
+     */
+    private function loadRecentGroupReleaseTitles(User $user, array $groupIds): Collection
+    {
+        $eligibleReleases = GroupRelease::query()
+            ->whereIn('group_id', $groupIds)
+            ->where('visibility', GroupRelease::VISIBILITY_PUBLIC)
+            ->where(function ($query) use ($user): void {
+                $query->where('lead_user_id', $user->id)
+                    ->orWhere('created_by_user_id', $user->id)
+                    ->orWhereHas('contributorLinks', fn ($contributorQuery) => $contributorQuery->where('user_id', $user->id));
+            })
+            ->select(['id', 'group_id', 'title', 'released_at', 'updated_at']);
+
+        $ranked = DB::query()
+            ->fromSub($eligibleReleases, 'eligible_group_releases')
+            ->select([
+                'group_id',
+                'title',
+                'released_at',
+                'updated_at',
+            ])
+            ->selectRaw('ROW_NUMBER() OVER (PARTITION BY group_id ORDER BY released_at DESC, updated_at DESC) as release_rank');
+
+        return DB::query()
+            ->fromSub($ranked, 'ranked_group_releases')
+            ->where('release_rank', '<=', 3)
+            ->orderBy('group_id')
+            ->orderBy('release_rank')
+            ->get(['group_id', 'title'])
+            ->groupBy('group_id')
+            ->map(fn ($rows) => $rows->pluck('title')->map(fn ($title): string => (string) $title)->values());
+    }
+
     private function resolveFavouriteTable(): ?string
     {
         foreach (['artwork_favourites', 'user_favorites', 'artworks_favourites', 'favourites'] as $table) {
@@ -1512,7 +1746,7 @@ class ProfileController extends Controller
     private function mapArtworkCardPayload(Artwork $art): array
     {
         $present = ThumbnailPresenter::present($art, 'md');
-        $category = $art->categories->first();
+        $category = $art->resolvedPrimaryCategory();
         $contentType = $category?->contentType;
         $stats = $art->stats;
         $group = $art->group;
@@ -1522,7 +1756,7 @@ class ProfileController extends Controller
         $avatarUrl = $isGroupPublisher ? $group->avatarUrl() : ($art->user?->profile?->avatar_url ?? null);
         $profileUrl = $isGroupPublisher
             ? $group->publicUrl()
-            : ($username ? '/@' . $username : null);
+            : ($username ? '/@'.$username : null);
         $publisherType = $isGroupPublisher ? 'group' : 'user';
 
         return app(ArtworkMaturityService::class)->decoratePayload([

app/Http/Controllers/User/TodayDownloadsController.php

@@ -3,7 +3,10 @@
 namespace App\Http\Controllers\User;
 
 use App\Http\Controllers\Controller;
+use App\Models\Artwork;
 use App\Models\ArtworkDownload;
+use App\Services\ThumbnailPresenter;
+use App\Support\AvatarUrl;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
@@ -54,7 +57,7 @@ class TodayDownloadsController extends Controller
         $paginator->getCollection()->transform(function ($row) {
             $art = $row->artwork ?? null;
             if (! $art && isset($row->artwork_id)) {
-                $art = \App\Models\Artwork::find($row->artwork_id);
+                $art = Artwork::find($row->artwork_id);
             }
 
             if (! $art) {
@@ -75,9 +78,9 @@ class TodayDownloadsController extends Controller
             $picture = $art->file_name ?? null;
             $ext = pathinfo($picture ?? '', PATHINFO_EXTENSION) ?: 'jpg';
             $encoded = null;
-            $present = $art ? \App\Services\ThumbnailPresenter::present($art, 'md') : null;
+            $present = $art ? ThumbnailPresenter::present($art, 'md') : null;
             $thumb = $present ? $present['url'] : 'https://files.skinbase.org/default/missing_md.webp';
-            $primaryCategory = $art->categories->first();
+            $primaryCategory = $art->resolvedPrimaryCategory();
             $categoryId = $primaryCategory->id ?? null;
             $categoryName = $primaryCategory->name ?? '';
             $categorySlug = $primaryCategory->slug ?? '';
@@ -98,7 +101,7 @@ class TodayDownloadsController extends Controller
                 'category_slug' => $categorySlug,
                 'uname' => $art->user->name ?? 'Skinbase',
                 'username' => $art->user->username ?? '',
-                'avatar_url' => \App\Support\AvatarUrl::forUser((int) ($art->user->id ?? 0), $avatarHash, 64),
+                'avatar_url' => AvatarUrl::forUser((int) ($art->user->id ?? 0), $avatarHash, 64),
                 'width' => $art->width,
                 'height' => $art->height,
                 'published_at' => $art->published_at,

app/Http/Controllers/User/TopAuthorsController.php

@@ -50,7 +50,8 @@ class TopAuthorsController extends Controller
         });
 
         $page_title = 'Top Creators';
+        $page_canonical = route('creators.top');
 
-        return view('web.authors.top', compact('page_title', 'authors', 'metric'));
+        return view('web.authors.top', compact('page_title', 'page_canonical', 'authors', 'metric'));
     }
 }

app/Http/Controllers/Web/ArtworkPageController.php

@@ -8,20 +8,19 @@ use App\Enums\ReactionType;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\ArtworkResource;
 use App\Models\Artwork;
-use App\Models\ArtworkComment;
+use App\Models\Category;
-use Illuminate\Support\Facades\DB;
+use App\Services\ArtworkNavigationService;
-use App\Services\ContentSanitizer;
+use App\Services\ArtworkRelatedService;
-use App\Services\ThumbnailPresenter;
 use App\Services\ErrorSuggestionService;
 use App\Services\GroupService;
 use App\Services\Maturity\ArtworkMaturityService;
+use App\Services\ThumbnailPresenter;
 use App\Support\Seo\SeoFactory;
-use App\Support\AvatarUrl;
-use Illuminate\Support\Carbon;
-use Illuminate\Support\Collection;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\Response;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Illuminate\View\View;
 use Inertia\Inertia;
@@ -32,6 +31,8 @@ final class ArtworkPageController extends Controller
     public function __construct(
         private readonly GroupService $groups,
         private readonly ArtworkMaturityService $maturity,
+        private readonly ArtworkNavigationService $navigation,
+        private readonly ArtworkRelatedService $relatedArtworks,
     ) {}
 
     public function show(Request $request, int $id, ?string $slug = null): View|RedirectResponse|Response|InertiaResponse
@@ -42,6 +43,7 @@ final class ArtworkPageController extends Controller
         if (! $raw) {
             // Artwork never existed → contextual 404
             $suggestions = app(ErrorSuggestionService::class);
+
             return response(view('errors.contextual.artwork-not-found', [
                 'trendingArtworks' => $this->safeSuggestions(fn () => $suggestions->trendingArtworks()),
             ]), 404);
@@ -76,8 +78,9 @@ final class ArtworkPageController extends Controller
                         ->limit(6)
                         ->get()
                         ->map(function (Artwork $a) {
-                            $slug = \Illuminate\Support\Str::slug((string) ($a->slug ?: $a->title)) ?: (string) $a->id;
+                            $slug = Str::slug((string) ($a->slug ?: $a->title)) ?: (string) $a->id;
-                            $md   = \App\Services\ThumbnailPresenter::present($a, 'md');
+                            $md = ThumbnailPresenter::present($a, 'md');
+
                             return [
                                 'id' => $a->id,
                                 'title' => html_entity_decode((string) $a->title, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
@@ -98,14 +101,21 @@ final class ArtworkPageController extends Controller
             ]), 403);
         }
 
-        // ── Step 2: full load with all relations ───────────────────────────
+        // ── Step 2: hydrate the already-validated model ────────────────────
-        $artwork = Artwork::with(['user.profile', 'group.owner.profile', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'categories.contentType', 'categories.parent.contentType', 'tags', 'stats', 'awardStat'])
+        // The initial withTrashed lookup is intentionally retained so that
-            ->where('id', $id)
+        // missing, deleted, private, and unpublished artwork keep their
-            ->public()
+        // distinct responses. Reusing that model avoids a second identical
-            ->published()
+        // primary-key lookup on the public path.
-            ->firstOrFail();
+        $artwork = $raw;
+        $artwork->load(['user.profile', 'group.owner.profile', 'uploadedBy.profile', 'primaryAuthor.profile', 'contributors.user.profile', 'categories.contentType', 'categories.parent.contentType', 'primaryCategory.contentType', 'primaryCategory.parent.contentType', 'tags', 'stats', 'awardStat']);
 
-        $this->loadCategoryAncestors($artwork->categories);
+        $this->loadCategoryAncestors(
+            $artwork->categories
+                ->concat(collect([$artwork->resolvedPrimaryCategory()]))
+                ->filter()
+                ->unique('id')
+                ->values()
+        );
 
         $canonicalSlug = Str::slug((string) ($artwork->slug ?: $artwork->title));
         if ($canonicalSlug === '') {
@@ -119,12 +129,15 @@ final class ArtworkPageController extends Controller
             ], 301);
         }
 
-        $thumbMd = ThumbnailPresenter::present($artwork, 'md');
-        $thumbLg = ThumbnailPresenter::present($artwork, 'lg');
-        $thumbXl = ThumbnailPresenter::present($artwork, 'xl');
-        $thumbSq = ThumbnailPresenter::present($artwork, 'sq');
-
         $artworkData = (new ArtworkResource($artwork))->toArray($request);
+        $navigationData = $this->navigation->navigationFor($artwork);
+        // ArtworkResource is the canonical thumbnail projection. Reuse its
+        // exact values for page props and SEO instead of presenting each
+        // variant a second time in the controller.
+        $thumbMd = $artworkData['thumbs']['md'] ?? [];
+        $thumbLg = $artworkData['thumbs']['lg'] ?? [];
+        $thumbXl = $artworkData['thumbs']['xl'] ?? [];
+        $thumbSq = $artworkData['thumbs']['sq'] ?? [];
         $groupSummary = null;
 
         if ($artwork->group) {
@@ -151,37 +164,7 @@ final class ArtworkPageController extends Controller
             'xl' => $thumbXl,
         ], $canonical, $this->artworkBreadcrumbs($artwork, $canonical))->toArray();
 
-        $categoryIds = $artwork->categories->pluck('id')->filter()->values();
+        $related = $this->relatedArtworks->related($artwork, $request->user(), 12)
-        $tagIds = $artwork->tags->pluck('id')->filter()->values();
-
-        $related = Artwork::query()
-            ->with(['user', 'group', 'categories.contentType'])
-            ->whereKeyNot($artwork->id)
-            ->public()
-            ->published()
-            ->tap(fn ($builder) => $this->maturity->applyViewerFilter($builder, $request->user()))
-            ->where(function ($query) use ($artwork, $categoryIds, $tagIds): void {
-                $query->where('user_id', $artwork->user_id);
-
-                if ($artwork->group_id) {
-                    $query->orWhere('group_id', $artwork->group_id);
-                }
-
-                if ($categoryIds->isNotEmpty()) {
-                    $query->orWhereHas('categories', function ($categoryQuery) use ($categoryIds): void {
-                        $categoryQuery->whereIn('categories.id', $categoryIds->all());
-                    });
-                }
-
-                if ($tagIds->isNotEmpty()) {
-                    $query->orWhereHas('tags', function ($tagQuery) use ($tagIds): void {
-                        $tagQuery->whereIn('tags.id', $tagIds->all());
-                    });
-                }
-            })
-            ->latest('published_at')
-            ->limit(12)
-            ->get()
             ->map(function (Artwork $item): array {
                 $itemSlug = Str::slug((string) ($item->slug ?: $item->title));
                 if ($itemSlug === '') {
@@ -200,90 +183,27 @@ final class ArtworkPageController extends Controller
                     'publisher_id' => $item->group ? (int) $item->group->id : (int) ($item->user?->id ?? 0),
                     'url' => route('art.show', ['id' => $item->id, 'slug' => $itemSlug]),
                     'thumb' => $sm['url'] ?? null,
-                    'thumb_srcset' => ($sm['url'] ?? '') . ' 320w, ' . ($md['url'] ?? '') . ' 640w',
+                    'thumb_srcset' => ($sm['url'] ?? '').' 320w, '.($md['url'] ?? '').' 640w',
                 ], $item, request()->user());
             })
             ->values()
             ->all();
 
-        $approvedComments = ArtworkComment::query()
-            ->with('user.profile')
-            ->where('artwork_id', $artwork->id)
-            ->where('is_approved', true)
-            ->orderBy('created_at')
-            ->limit(500)
-            ->get();
-
-        $commentsByParent = $approvedComments->groupBy(
-            static fn (ArtworkComment $comment): string => $comment->parent_id === null
-                ? 'root'
-                : (string) $comment->parent_id
-        );
-
-        // Recursive helper to format a comment and its nested replies.
-        $formatComment = null;
-        $formatComment = function (ArtworkComment $c) use (&$formatComment, $commentsByParent): array {
-            /** @var Collection<int, ArtworkComment> $replies */
-            $replies = $commentsByParent->get((string) $c->id, collect());
-            $user = $c->user;
-            $userId = (int) ($c->user_id ?? 0);
-            $avatarHash = $user?->profile?->avatar_hash ?? null;
-            $canPublishLinks = (int) ($user?->level ?? 1) > 1 && strtolower((string) ($user?->rank ?? 'Newbie')) !== 'newbie';
-            $rawContent = (string) ($c->raw_content ?? $c->content ?? '');
-            $renderedContent = $c->rendered_content;
-
-            if (! is_string($renderedContent) || trim($renderedContent) === '') {
-                $renderedContent = $rawContent !== ''
-                    ? ContentSanitizer::render($rawContent)
-                    : nl2br(e(strip_tags((string) ($c->content ?? ''))));
-            }
-
-            return [
-                'id'               => $c->id,
-                'parent_id'        => $c->parent_id,
-                'content'          => html_entity_decode((string) $c->content, ENT_QUOTES | ENT_HTML5, 'UTF-8'),
-                'raw_content'      => $c->raw_content ?? $c->content,
-                'rendered_content' => ContentSanitizer::sanitizeRenderedHtml($renderedContent, $canPublishLinks),
-                'created_at'       => $c->created_at?->toIso8601String(),
-                'time_ago'         => $c->created_at ? Carbon::parse($c->created_at)->diffForHumans() : null,
-                'user'             => [
-                    'id'          => $userId,
-                    'name'        => $user?->name,
-                    'username'    => $user?->username,
-                    'display'     => $user?->username ?? $user?->name ?? 'User',
-                    'profile_url' => $user?->username ? '/@' . $user->username : ($userId > 0 ? '/profile/' . $userId : null),
-                    'avatar_url'  => $avatarHash !== null
-                        ? AvatarUrl::forUser($userId, $avatarHash, 64)
-                        : AvatarUrl::default(),
-                    'level'       => (int) ($user?->level ?? 1),
-                    'rank'        => (string) ($user?->rank ?? 'Newbie'),
-                ],
-                'replies' => $replies->map($formatComment)->values()->all(),
-            ];
-        };
-
-        $comments = $commentsByParent
-            ->get('root', collect())
-            ->map($formatComment)
-            ->values()
-            ->all();
-
         $canReadSession = $request->hasSession() && ! $request->attributes->get('skinbase.session_skipped');
-
+        $viewerId = ($canReadSession && $request->user() !== null) ? (int) $request->user()->id : null;
-        $userId = ($canReadSession && $request->user() !== null) ? (int) $request->user()->id : null;
 
         return Inertia::render('ArtworkPage', [
             'artwork' => $artworkData,
+            'navigation' => $navigationData,
             'presentMd' => $thumbMd,
             'presentLg' => $thumbLg,
             'presentXl' => $thumbXl,
             'presentSq' => $thumbSq,
             'related' => $related,
             'canonicalUrl' => $canonical,
-            'comments'        => $comments,
             'groupSummary' => $groupSummary,
-            'isAuthenticated' => $userId !== null,
+            'isAuthenticated' => $viewerId !== null,
-            'reactionTotals'  => $this->artworkReactionTotals((int) $artwork->id, $userId),
+            'reactionTotals' => $this->artworkReactionTotals((int) $artwork->id, $viewerId),
             'seo' => $seo,
         ])->rootView('artworks.show');
     }
@@ -343,7 +263,7 @@ final class ArtworkPageController extends Controller
                 ->values();
 
             if ($missingParentIds->isNotEmpty()) {
-                $fetchedParents = \App\Models\Category::query()
+                $fetchedParents = Category::query()
                     ->with('contentType')
                     ->whereIn('id', $missingParentIds->all())
                     ->get()
@@ -369,12 +289,7 @@ final class ArtworkPageController extends Controller
      */
     private function artworkBreadcrumbs(Artwork $artwork, string $canonical): array
     {
-        $primaryCategory = $artwork->categories
+        $primaryCategory = $artwork->resolvedPrimaryCategory();
-            ->sortBy(fn ($category) => [
-                (int) ($category->sort_order ?? 0),
-                (string) ($category->name ?? ''),
-            ])
-            ->first();
 
         if ($primaryCategory === null) {
             return [
@@ -399,7 +314,7 @@ final class ArtworkPageController extends Controller
         if ($contentTypeSlug !== '' && $contentTypeName !== '') {
             $breadcrumbs[] = [
                 'name' => $contentTypeName,
-                'url' => url('/' . $contentTypeSlug),
+                'url' => url('/'.$contentTypeSlug),
             ];
         }
 
@@ -416,7 +331,7 @@ final class ArtworkPageController extends Controller
             $pathSegments[] = $slug;
             $breadcrumbs[] = [
                 'name' => $name,
-                'url' => url('/' . $contentTypeSlug . '/' . implode('/', $pathSegments)),
+                'url' => url('/'.$contentTypeSlug.'/'.implode('/', $pathSegments)),
             ];
         }
 

app/Http/Controllers/Web/DiscoverController.php

@@ -65,6 +65,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $results,
             'page_title'  => 'Trending Artworks',
+            'page_canonical' => $this->canonicalRoute('discover.trending'),
             'section'     => 'trending',
             'description' => 'The most-viewed artworks on Skinbase over the past 7 days.',
             'icon'        => 'fa-fire',
@@ -97,6 +98,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $results,
             'page_title'  => 'Rising Now',
+            'page_canonical' => $this->canonicalRoute('discover.rising'),
             'section'     => 'rising',
             'description' => 'Fastest growing artworks right now.',
             'icon'        => 'fa-rocket',
@@ -119,6 +121,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $results,
             'page_title'  => 'Fresh Uploads',
+            'page_canonical' => $this->canonicalRoute('discover.fresh'),
             'section'     => 'fresh',
             'description' => 'The latest artworks just uploaded to Skinbase.',
             'icon'        => 'fa-bolt',
@@ -138,6 +141,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $results,
             'page_title'  => 'Top Rated Artworks',
+            'page_canonical' => $this->canonicalRoute('discover.top-rated'),
             'section'     => 'top-rated',
             'description' => 'The most-loved artworks on Skinbase, ranked by community favourites.',
             'icon'        => 'fa-medal',
@@ -157,6 +161,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $results,
             'page_title'  => 'Most Downloaded',
+            'page_canonical' => $this->canonicalRoute('discover.most-downloaded'),
             'section'     => 'most-downloaded',
             'description' => 'All-time most downloaded artworks on Skinbase.',
             'icon'        => 'fa-download',
@@ -178,9 +183,9 @@ final class DiscoverController extends Controller
                 'categories:id,name,slug,content_type_id,parent_id,sort_order',
                 'categories.contentType:id,slug,name',
             ])
-            ->whereRaw('MONTH(published_at) = ?', [$today->month])
+            ->whereMonth('published_at', $today->month)
-            ->whereRaw('DAY(published_at) = ?',   [$today->day])
+            ->whereDay('published_at', $today->day)
-            ->whereRaw('YEAR(published_at) < ?',   [$today->year])
+            ->whereYear('published_at', '<', $today->year)
             ->orderMissingThumbnailsLast()
             ->orderByDesc('published_at')
             ->paginate($perPage)
@@ -191,6 +196,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $artworks,
             'page_title'  => 'On This Day',
+            'page_canonical' => $this->canonicalRoute('discover.on-this-day'),
             'section'     => 'on-this-day',
             'description' => 'Artworks published on ' . $today->format('F j') . ' in previous years.',
             'icon'        => 'fa-calendar-day',
@@ -246,6 +252,7 @@ final class DiscoverController extends Controller
         return view('web.creators.rising', [
             'creators'   => $creators,
             'page_title' => 'Rising Creators — Skinbase',
+            'page_canonical' => $this->canonicalRoute('creators.rising'),
         ]);
     }
 
@@ -327,6 +334,7 @@ final class DiscoverController extends Controller
             return view('web.discover.index', [
                 'artworks'           => collect(),
                 'page_title'         => 'Following Feed',
+                'page_canonical'     => $this->canonicalRoute('discover.following'),
                 'section'            => 'following',
                 'description'        => 'Follow some creators to see their work here.',
                 'icon'               => 'fa-user-group',
@@ -366,6 +374,7 @@ final class DiscoverController extends Controller
         return view('web.discover.index', [
             'artworks'    => $artworks,
             'page_title'  => 'Following Feed',
+            'page_canonical' => $this->canonicalRoute('discover.following'),
             'section'     => 'following',
             'description' => 'The latest artworks from creators you follow.',
             'icon'        => 'fa-user-group',
@@ -388,6 +397,11 @@ final class DiscoverController extends Controller
         return ! $items || $items->isEmpty();
     }
 
+    private function canonicalRoute(string $routeName): string
+    {
+        return route($routeName);
+    }
+
     private function paginatorHasNoRisingMomentum($paginator): bool
     {
         if (! is_object($paginator) || ! method_exists($paginator, 'getCollection')) {

app/Http/Controllers/Web/SearchController.php

@@ -11,6 +11,7 @@ use App\Services\GroupDiscoveryService;
 use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Arr;
 use Illuminate\View\View;
 use cPad\Plugins\News\Models\NewsArticle;
@@ -19,6 +20,12 @@ final class SearchController extends Controller
 {
     private const ALLOWED_SORTS = ['latest', 'popular', 'likes', 'downloads'];
 
+    /** Reject requests with an absurd number of query params before touching search/DB. */
+    private const MAX_QUERY_PARAMS = 15;
+
+    /** Reject requests with an absurdly long query string before touching search/DB. */
+    private const MAX_QUERY_STRING_LENGTH = 500;
+
     public function __construct(
         private readonly ArtworkSearchService $search,
         private readonly GroupDiscoveryService $groups,
@@ -26,6 +33,8 @@ final class SearchController extends Controller
 
     public function index(Request $request): View|RedirectResponse
     {
+        $this->rejectMalformedQuery($request);
+
         $canonicalQuery = $this->canonicalQueryParameters($request);
         $canonicalUrl = $this->canonicalSearchUrl($request, $canonicalQuery);
 
@@ -110,6 +119,21 @@ final class SearchController extends Controller
         ]);
     }
 
+    /**
+     * Bail out before any search/DB work for junk requests — e.g. scripted
+     * floods that repeat/nest query params (group=all&page=..&sort=.. etc.).
+     */
+    private function rejectMalformedQuery(Request $request): void
+    {
+        $query = $request->query();
+
+        if (count($query) > self::MAX_QUERY_PARAMS
+            || strlen((string) $request->getQueryString()) > self::MAX_QUERY_STRING_LENGTH
+        ) {
+            abort(Response::HTTP_BAD_REQUEST);
+        }
+    }
+
     /**
      * @return array<string, int|string>
      */

app/Http/Controllers/Web/SimilarArtworksPageController.php

@@ -72,7 +72,7 @@ final class SimilarArtworksPageController extends Controller
             'thumb_srcset' => $sourceMd['srcset'] ?? $sourceMd['url'] ?? null,
             'author_name' => $source->user?->name ?? 'Artist',
             'author_username' => $source->user?->username ?? '',
-            'author_profile_url'=> $source->user?->username ? '/@' . $source->user->username : null,
+            'author_profile_url' => $source->user?->username ? '/@'.$source->user->username : null,
             'author_avatar' => AvatarUrl::forUser(
                 (int) ($source->user_id ?? 0),
                 $source->user?->profile?->avatar_hash ?? null,
@@ -82,7 +82,7 @@ final class SimilarArtworksPageController extends Controller
             'category_slug' => $primaryCat?->slug ?? '',
             'content_type_name' => $primaryCat?->contentType?->name ?? '',
             'content_type_slug' => $primaryCat?->contentType?->slug ?? '',
-            'browse_url'        => $primaryCat?->contentType?->slug ? url('/' . $primaryCat->contentType->slug) : url('/explore'),
+            'browse_url' => $primaryCat?->contentType?->slug ? url('/'.$primaryCat->contentType->slug) : url('/explore'),
             'tag_slugs' => $source->tags->pluck('slug')->take(5)->all(),
             'width' => $source->width ?? null,
             'height' => $source->height ?? null,
@@ -99,8 +99,8 @@ final class SimilarArtworksPageController extends Controller
             'spotlight' => collect(),
             'current_sort' => 'trending',
             'sort_options' => [],
-            'page_title'            => 'Similar to "' . $sourceTitle . '" — Skinbase',
+            'page_title' => 'Similar to "'.$sourceTitle.'" — Skinbase',
-            'page_meta_description' => 'Discover artworks similar to "' . $sourceTitle . '" on Skinbase.',
+            'page_meta_description' => 'Discover artworks similar to "'.$sourceTitle.'" on Skinbase.',
             'page_canonical' => $baseUrl,
             'page_robots' => 'index,follow',
             'breadcrumbs' => collect([
@@ -171,16 +171,13 @@ final class SimilarArtworksPageController extends Controller
      */
     private function resolveSimilarArtworks(Artwork $source, int $page, string $baseUrl): array
     {
-        // Priority 1 — Qdrant visual (vision) similarity
+        // Priority 1 — Qdrant visual (vision) similarity.
+        // Paginate IDs before hydrating/presenting full Artwork models so a
+        // request only pays the relation/presenter cost for the current page.
         if ($this->vectors->isConfigured()) {
-            $qdrantItems = $this->resolveViaQdrant($source);
+            $qdrantPaginator = $this->resolveViaQdrant($source, $page, $baseUrl);
-            if ($qdrantItems !== null && $qdrantItems->isNotEmpty()) {
+            if ($qdrantPaginator !== null && $qdrantPaginator->total() > 0) {
-                $paginator = $this->paginateCollection(
+                return [$qdrantPaginator, 'visual'];
-                    $qdrantItems->map(fn ($a) => $this->presentArtwork($a)),
-                    $page,
-                    $baseUrl,
-                );
-                return [$paginator, 'visual'];
             }
         }
 
@@ -192,55 +189,108 @@ final class SimilarArtworksPageController extends Controller
                 $page,
                 $baseUrl,
             );
+
             return [$paginator, 'hybrid'];
         }
 
         // Priority 3 — Meilisearch tag/category overlap
         $paginator = $this->meilisearchFallback($source, $page);
+
         return [$paginator, 'tags'];
     }
 
     /**
-     * Query Qdrant via VectorGateway, then re-hydrate full Artwork models
+     * Query Qdrant via VectorGateway, preserve relevance order, then paginate
-     * (so we have category/dimension data for the masonry grid).
+     * candidate IDs before hydrating full Artwork models for the current page.
      *
-     * Returns null when the gateway call fails, so the caller can fall through.
+     * The light eligibility query keeps the existing public/published semantics
+     * for cached Qdrant results without loading relations for every candidate.
+     * Returns null when the gateway call fails or no eligible candidates remain,
+     * allowing the caller to continue to the existing hybrid/tag fallbacks.
      */
-    private function resolveViaQdrant(Artwork $source): ?Collection
+    private function resolveViaQdrant(
-    {
+        Artwork $source,
+        int $page,
+        string $baseUrl,
+    ): ?LengthAwarePaginator {
         try {
             $raw = $this->vectors->similarToArtwork($source, self::QDRANT_LIMIT);
         } catch (RuntimeException) {
             return null;
         }
 
-        if (empty($raw)) {
+        if ($raw === []) {
             return null;
         }
 
-        // Preserve Qdrant relevance order; IDs are already filtered to public+published
+        // Preserve Qdrant relevance order while normalising IDs defensively.
-        $orderedIds = array_column($raw, 'id');
+        $orderedIds = collect(array_column($raw, 'id'))
+            ->map(static fn ($id): int => is_numeric($id) ? (int) $id : 0)
+            ->filter(static fn (int $id): bool => $id > 0 && $id !== (int) $source->id)
+            ->unique()
+            ->values();
 
+        if ($orderedIds->isEmpty()) {
+            return null;
+        }
+
+        // Keep cached Qdrant results honest if an artwork has since become
+        // private/unpublished. Fetch IDs only; do not hydrate relations yet.
+        $eligibleSet = Artwork::query()
+            ->whereIn('id', $orderedIds->all())
+            ->public()
+            ->published()
+            ->pluck('id')
+            ->mapWithKeys(static fn ($id): array => [(int) $id => true]);
+
+        $eligibleIds = $orderedIds
+            ->filter(static fn (int $id): bool => $eligibleSet->has($id))
+            ->values();
+
+        if ($eligibleIds->isEmpty()) {
+            return null;
+        }
+
+        $perPage = self::PER_PAGE;
+        $total = $eligibleIds->count();
+        $pageIds = $eligibleIds->forPage($page, $perPage)->values();
+
+        $items = collect();
+
+        if ($pageIds->isNotEmpty()) {
             $artworks = Artwork::query()
-            ->whereIn('id', $orderedIds)
+                ->whereIn('id', $pageIds->all())
-            ->where('id', '!=', $source->id)   // belt-and-braces exclusion
                 ->public()
                 ->published()
                 ->with([
-                'categories:id,slug,name',
+                    'categories:id,slug,name,content_type_id',
                     'categories.contentType:id,name,slug',
                     'user:id,name,username',
                     'user.profile:user_id,avatar_hash',
+                    'group:id,name,slug,avatar_path',
                 ])
                 ->get()
                 ->keyBy('id');
 
-        return collect($orderedIds)
+            $items = $pageIds
                 ->map(fn (int $id) => $artworks->get($id))
                 ->filter()
+                ->map(fn (Artwork $artwork) => $this->presentArtwork($artwork))
                 ->values();
         }
 
+        return new LengthAwarePaginator(
+            $items,
+            $total,
+            $perPage,
+            $page,
+            [
+                'path' => $baseUrl,
+                'query' => [],
+            ],
+        );
+    }
+
     /**
      * Meilisearch tag-overlap query with category fallback.
      */
@@ -252,15 +302,15 @@ final class SimilarArtworksPageController extends Controller
         $filterParts = [
             'is_public = true',
             'is_approved = true',
-            'id != ' . $source->id,
+            'id != '.$source->id,
         ];
 
         if ($tagSlugs !== []) {
-            $quoted        = array_map(fn (string $t): string => 'tags = "' . addslashes($t) . '"', $tagSlugs);
+            $quoted = array_map(fn (string $t): string => 'tags = "'.addslashes($t).'"', $tagSlugs);
-            $filterParts[] = '(' . implode(' OR ', $quoted) . ')';
+            $filterParts[] = '('.implode(' OR ', $quoted).')';
         } elseif ($categorySlugs !== []) {
-            $quoted        = array_map(fn (string $c): string => '(category = "' . addslashes($c) . '" OR categories = "' . addslashes($c) . '")', $categorySlugs);
+            $quoted = array_map(fn (string $c): string => '(category = "'.addslashes($c).'" OR categories = "'.addslashes($c).'")', $categorySlugs);
-            $filterParts[] = '(' . implode(' OR ', $quoted) . ')';
+            $filterParts[] = '('.implode(' OR ', $quoted).')';
         }
 
         $results = Artwork::search('')->options([
@@ -268,6 +318,14 @@ final class SimilarArtworksPageController extends Controller
             'sort' => ['trending_score_7d:desc', 'created_at:desc'],
         ])->paginate(self::PER_PAGE, 'page', $page);
 
+        $results->getCollection()->load([
+            'categories:id,slug,name,content_type_id',
+            'categories.contentType:id,name,slug',
+            'user:id,name,username',
+            'user.profile:user_id,avatar_hash',
+            'group:id,name,slug,avatar_path',
+        ]);
+
         $results->getCollection()->transform(fn ($a) => $this->presentArtwork($a));
 
         return $results;
@@ -308,7 +366,7 @@ final class SimilarArtworksPageController extends Controller
             );
         $displayName = $isGroupPublisher ? ($group->name ?? 'Skinbase') : ($artwork->user?->name ?? 'Skinbase');
         $username = $isGroupPublisher ? '' : ($artwork->user?->username ?? '');
-        $profileUrl = $isGroupPublisher ? $group->publicUrl() : ($username !== '' ? '/@' . $username : null);
+        $profileUrl = $isGroupPublisher ? $group->publicUrl() : ($username !== '' ? '/@'.$username : null);
 
         return (object) $this->maturity->decoratePayload([
             'id' => $artwork->id,

app/Http/Controllers/Web/TagController.php

@@ -51,7 +51,7 @@ final class TagController extends Controller
         $artworks = $this->search->byTag($tag->slug, $perPage, $sort);
 
         // Eager-load relations used by the gallery presenter and thumbnails.
-        $artworks->getCollection()->each(fn($m) => $m->loadMissing(['user.profile', 'categories']));
+        $artworks->getCollection()->loadMissing(['user.profile', 'categories.contentType']);
 
         // Sidebar: main content type links (same as browse gallery)
         $mainCategories = ContentType::ordered()->where('hide_from_menu', false)->get(['name', 'slug'])

app/Http/Controllers/Web/WorldWebStoryController.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Web;
+
+use App\Http\Controllers\Controller;
+use App\Models\WorldWebStory;
+use App\Services\WebStories\WorldWebStorySeoService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\View\View;
+
+final class WorldWebStoryController extends Controller
+{
+    public function __construct(private readonly WorldWebStorySeoService $seo)
+    {
+    }
+
+    public function index(Request $request): View
+    {
+        $stories = Cache::remember('web_story_index', 300, fn () => WorldWebStory::query()
+            ->with('world')
+            ->visible()
+            ->orderByDesc('featured')
+            ->orderByDesc('published_at')
+            ->paginate(12)
+            ->withQueryString());
+
+        return view('web-stories.index', [
+            'stories' => $stories,
+            'seo' => $this->seo->indexSeo(),
+            'useUnifiedSeo' => true,
+        ]);
+    }
+
+    public function show(string $slug): View
+    {
+        $story = Cache::remember('web_story:' . $slug, 300, fn () => WorldWebStory::query()
+            ->with(['world', 'orderedPages.artwork.user'])
+            ->visible()
+            ->where('slug', $slug)
+            ->first());
+
+        abort_unless($story instanceof WorldWebStory, 404);
+
+        return view('web-stories.show', [
+            'story' => $story,
+            'meta' => $this->seo->storyMeta($story),
+        ]);
+    }
+}

app/Http/Middleware/AddServerTiming.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Negligible-overhead request duration header for production HTTP profiling.
+ * Does not log queries or payloads.
+ */
+final class AddServerTiming
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $started = hrtime(true);
+        $response = $next($request);
+        $durationMs = (hrtime(true) - $started) / 1_000_000;
+
+        if (headers_sent()) {
+            return $response;
+        }
+
+        $metrics = ['app;desc="Laravel";dur='.number_format($durationMs, 1, '.', '')];
+        $ssrMs = $request->attributes->get('http.ssr_ms');
+        if (is_numeric($ssrMs) && (float) $ssrMs >= 0) {
+            $metrics[] = 'ssr;desc="Inertia SSR";dur='.number_format((float) $ssrMs, 1, '.', '');
+        }
+
+        $metric = implode(', ', $metrics);
+        $existing = $response->headers->get('Server-Timing');
+
+        $response->headers->set(
+            'Server-Timing',
+            $existing ? $existing.', '.$metric : $metric,
+        );
+
+        return $response;
+    }
+}