@taskforcehq/taskforce 0.3.301 → 0.3.303

package/dist/server/routes.test.js

@@ -236,6 +236,7 @@ vi.mock('../core/Taskforce', () => {
             setSystemRole = vi.fn().mockReturnValue(true);
             setUserDisabledGlobal = vi.fn().mockReturnValue(true);
             setUserBetaAccessGlobal = vi.fn().mockReturnValue(true);
+            purgeSystemUser = vi.fn();
             updateWorkspaceUserRole = vi.fn();
             inviteWorkspaceUser = vi.fn();
             updateWorkspaceProfile = vi.fn().mockImplementation((workspaceId, input) => ({
@@ -262,17 +263,16 @@ vi.mock('../core/Taskforce', () => {
             revokeInviteAcceptanceForUser = vi.fn().mockReturnValue({ revoked: 1 });
             getWorkspacePlanMode = vi.fn().mockReturnValue('team');
             setWorkspacePlanMode = vi.fn().mockImplementation((_workspaceId, mode) => mode);
-            getSignupMonetizationSettings = vi.fn().mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+            getOnboardingPolicy = vi.fn().mockReturnValue({
+                mode: 'require_plan_selection',
+                planVersionId: null
             });
-            validateSignupMonetizationSettings = vi.fn().mockReturnValue({ valid: true });
+            validateOnboardingPolicy = vi.fn().mockReturnValue({ valid: true });
             getAccountAccessStatus = vi.fn().mockReturnValue({
                 gate: 'ok',
                 hasEntitlement: true,
                 canAccessApp: true,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: null,
                 entitlement: {
@@ -462,10 +462,22 @@ vi.mock('../core/Taskforce', () => {
             }));
             resolveUserIdentity = vi.fn().mockImplementation((userId) => {
                 if (userId === 'admin-user') {
-                    return { userId, email: 'admin@example.com' };
+                    return { userId, email: 'admin@example.com', avatarUrl: null };
                 }
                 return null;
             });
+            updateUserProfile = vi.fn().mockImplementation((userId, input) => ({
+                userId,
+                email: `${userId}@example.com`,
+                displayName: input.displayName,
+                avatarUrl: input.avatarUrl === undefined ? null : input.avatarUrl
+            }));
+            createUserAvatarUploadDraft = vi.fn();
+            getUserAvatarUploadDraft = vi.fn().mockReturnValue(null);
+            markUserAvatarUploadDraftFinalized = vi.fn().mockReturnValue(null);
+            markUserAvatarUploadDraftConsumed = vi.fn().mockReturnValue(null);
+            discardUserAvatarUploadDraft = vi.fn().mockReturnValue(null);
+            cleanupStaleUserAvatarUploadDrafts = vi.fn().mockReturnValue([]);
             resolvePreferredWorkspaceId = vi.fn().mockImplementation((options) => (options?.allowDefault ? 'default' : null));
             resolvePreferredUserWorkspaceId = vi.fn().mockImplementation((_userId, options) => {
                 const preferred = String(options?.preferredWorkspaceId || '').trim();
@@ -863,6 +875,8 @@ describe('Server Routes', () => {
                 authorization: 'Bearer tfmcp_ai_header_token',
                 'x-taskforce-ai-name': 'Automation Codex',
                 'x-taskforce-ai-profile-token': 'tfp_automation_codex',
+                'x-taskforce-ai-icon': 'Code2',
+                'x-taskforce-ai-color': '#10a37f',
                 'x-taskforce-ai-description': 'OpenAI Codex coding agent connected through MCP.',
                 'x-taskforce-ai-role': 'Coding Agent',
                 'x-taskforce-ai-provider': 'OpenAI',
@@ -3511,7 +3525,11 @@ describe('Server Routes', () => {
             const req = createMockReq('POST', '/api/taskforce/task', newTask);
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.createTask).toHaveBeenCalledWith(newTask, { workspaceId: 'default', actorRef: 'user' });
+            expect(core.createTask).toHaveBeenCalledWith(newTask, {
+                workspaceId: 'default',
+                actorRef: 'user',
+                provisionalLocalReference: true
+            });
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify(createdTask));
         });
@@ -3591,7 +3609,7 @@ describe('Server Routes', () => {
                 const payload = JSON.parse(res.end.mock.calls[0][0]);
                 expect(payload?.config?.baseUrl).toBe('http://127.0.0.1:4271');
                 expect(payload?.config?.apiBaseUrl).toBe('http://127.0.0.1:4271');
-                expect(payload?.config?.cloudAuthBaseUrl).toBe('http://127.0.0.1:4271');
+                expect(payload?.config?.cloudAuthBaseUrl).toBe('https://app.taskforcehq.ai');
                 expect(payload?.config?.wsBaseUrl).toBe('http://127.0.0.1:4271');
                 expect(payload?.config?.cloudMcpBaseUrl).toBe('https://mcp.taskforcehq.ai');
             }
@@ -3655,7 +3673,7 @@ describe('Server Routes', () => {
                     process.env.VITE_TASKFORCE_API_BASE_URL = previousApiBaseUrl;
             }
         });
-        it('POST /api/taskforce/auth/register should create account and set session cookie', async () => {
+        it('POST /api/taskforce/auth/register should create account without a session cookie when verification is required', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3688,6 +3706,7 @@ describe('Server Routes', () => {
                 email: 'owner@example.com',
                 role: 'owner'
             }));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":true'));
         });
@@ -3723,7 +3742,7 @@ describe('Server Routes', () => {
                 workspaceId: undefined,
                 role: 'member'
             }));
-            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
+            expect(res.setHeader).not.toHaveBeenCalledWith('Set-Cookie', expect.any(String));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"workspaceSetupRequired":true'));
         });
@@ -3762,6 +3781,7 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.requestEmailVerification).not.toHaveBeenCalled();
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(201, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"verificationRequired":false'));
         });
@@ -3836,7 +3856,7 @@ describe('Server Routes', () => {
                 code: 'EMAIL_ALREADY_EXISTS'
             }));
         });
-        it('POST /api/taskforce/auth/register should fail when signup monetization is misconfigured', async () => {
+        it('POST /api/taskforce/auth/register should fail when the onboarding policy is misconfigured', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
                 enabled: true,
@@ -3849,7 +3869,7 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
-            const error = new Error('Configured default signup plan version "missing-v9" was not found.');
+            const error = new Error('Configured onboarding plan version "missing-v9" was not found.');
             error.statusCode = 500;
             error.code = 'SIGNUP_PLAN_VERSION_NOT_FOUND';
             core.registerPasswordUser.mockImplementationOnce(() => {
@@ -3865,7 +3885,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(500, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
                 success: false,
-                error: 'Configured default signup plan version "missing-v9" was not found.',
+                error: 'Configured onboarding plan version "missing-v9" was not found.',
                 code: 'SIGNUP_PLAN_VERSION_NOT_FOUND'
             }));
         });
@@ -3882,12 +3902,19 @@ describe('Server Routes', () => {
                 sessionTtlSeconds: 3600
             };
             routes = createRoutes(core, { authConfig });
+            core.inspectOneTimeAuthToken = vi.fn().mockReturnValueOnce({
+                state: 'valid',
+                userId: 'u-verify',
+                workspaceId: 'workspace-1'
+            });
             core.verifyEmailWithToken.mockReturnValueOnce(true);
             const match = matchRoute('POST', '/api/taskforce/auth/verify-email/confirm', routes);
             const req = createMockReq('POST', '/api/taskforce/auth/verify-email/confirm', { token: 'tok1' });
             const res = createMockRes();
             await match?.handler(req, res, {});
+            expect(core.inspectOneTimeAuthToken).toHaveBeenCalledWith('tok1', 'email_verification');
             expect(core.verifyEmailWithToken).toHaveBeenCalledWith('tok1');
+            expect(res.setHeader).toHaveBeenCalledWith('Set-Cookie', expect.stringContaining('taskforce_session='));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/auth/password-reset/confirm should set new password', async () => {
@@ -4172,6 +4199,44 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
         });
+        it('POST /api/taskforce/auth/login should treat string false as disabled verified-email enforcement', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            core.getGlobalSettings.mockReturnValue({
+                auth: {
+                    allowSelfRegistration: true,
+                    requireVerifiedEmail: 'false'
+                }
+            });
+            routes = createRoutes(core, { authConfig });
+            core.resolvePreferredUserWorkspaceId.mockReturnValueOnce(null);
+            core.authenticatePasswordUserDetailed.mockReturnValueOnce({
+                ok: true,
+                access: { userId: 'u2', workspaceId: 'default', role: 'member' }
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/login', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/login', {
+                email: 'user@example.com',
+                password: 'password123'
+            });
+            const res = createMockRes();
+            res.setHeader = vi.fn();
+            await match?.handler(req, res, {});
+            expect(core.authenticatePasswordUserDetailed).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                requireVerifiedEmail: false
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
         it('POST /api/taskforce/auth/login should re-scope default session workspace to accessible membership', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -4723,10 +4788,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
-                archived: [{ id: 'task-2', title: 'Task 2', isArchived: true }]
-            }, 'workspace-1');
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
+                archived: [expect.objectContaining({ id: 'task-2', title: 'Task 2', isArchived: true })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"success":true'));
             expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
@@ -6371,10 +6436,10 @@ describe('Server Routes', () => {
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(core.deleteTaskForSync).toHaveBeenCalledWith('task-2', 'workspace-local', { persistBackup: false });
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local');
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should apply document review session upserts and deletes', async () => {
@@ -6812,10 +6877,10 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-shared-1', title: 'Shared task' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-shared-1', title: 'Shared task' })],
                 archived: []
-            }, 'workspace-shared-local');
+            }), 'workspace-shared-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should route archived upserts and preserve canceledReason', async () => {
@@ -6842,17 +6907,17 @@ describe('Server Routes', () => {
             });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-cancelled',
                         title: 'Cancelled + Archived',
                         status: 'cancelled',
                         canceledReason: 'Scope changed',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-local');
+                    })]
+            }), 'workspace-local');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/apply-local should prioritize delete over same-task upsert', async () => {
@@ -7519,10 +7584,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res1 = createMockRes();
             await match?.handler(req1, res1, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res1.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const firstPayload = JSON.parse(String(res1.end.mock.calls.at(-1)?.[0] || '{}'));
             expect(Array.isArray(firstPayload.emittedEventIds)).toBe(true);
@@ -7724,10 +7789,10 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{ id: 'task-1', title: 'Task 1' }],
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({ id: 'task-1', title: 'Task 1' })],
                 archived: []
-            }, 'workspace-local-active');
+            }), 'workspace-local-active');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(core.listUserWorkspaces).toHaveBeenCalledWith('user-1');
         });
@@ -8004,15 +8069,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-cancelled-1',
                         title: 'Cancelled Task',
                         status: 'cancelled',
                         canceledReason: 'No longer needed'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should preserve workstreamId in upsert payload', async () => {
@@ -8053,15 +8118,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
-                tasks: [{
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
+                tasks: [expect.objectContaining({
                         id: 'task-workstream-1',
                         title: 'Linked task',
                         status: 'task',
                         workstreamId: 'workstream-1'
-                    }],
+                    })],
                 archived: []
-            }, 'workspace-1');
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('POST /api/taskforce/sync/workspace/push should route archived upserts into archived snapshot list', async () => {
@@ -8102,15 +8167,15 @@ describe('Server Routes', () => {
             }, { cookie });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith({
+            expect(core.applyWorkspaceSyncSnapshot).toHaveBeenCalledWith(expect.objectContaining({
                 tasks: [],
-                archived: [{
+                archived: [expect.objectContaining({
                         id: 'task-archived-1',
                         title: 'Archived Task',
                         workstreamId: 'workstream-archived-1',
                         isArchived: true
-                    }]
-            }, 'workspace-1');
+                    })]
+            }), 'workspace-1');
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
         it('GET /api/taskforce/sync/workspace/pull should include canceledReason and archived marker in response payload', async () => {
@@ -8236,7 +8301,7 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             const response = JSON.parse(String(res.end.mock.calls[0]?.[0] || '{}'));
             const changes = Array.isArray(response?.changes) ? response.changes : [];
-            expect(changes).toContainEqual({
+            expect(changes).toContainEqual(expect.objectContaining({
                 op: 'taxonomy-upsert',
                 taxonomyState: {
                     categories: [{ value: 'default', label: 'General' }],
@@ -8272,8 +8337,9 @@ describe('Server Routes', () => {
                         filterEnabled: true,
                         sortEnabled: true
                     }],
+                updatedAt: '2026-02-22T10:00:00.000Z',
                 watermark: '2026-02-22T10:00:00.000Z'
-            });
+            }));
         });
         it('POST /api/taskforce/workspaces should create workspace for authenticated user', async () => {
             const authConfig = {
@@ -8673,6 +8739,215 @@ describe('Server Routes', () => {
             expect(payload.betaAccess).toBe(false);
             expect(core.getUserBetaAccess).toHaveBeenCalledWith('u-no-workspace');
         });
+        it('GET /api/taskforce/auth/session should expose avatarUrl from the resolved profile', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.resolveUserIdentity.mockReturnValueOnce({
+                userId: 'u-avatar',
+                email: 'avatar@example.com',
+                displayName: 'Avatar User',
+                avatarUrl: '/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png'
+            });
+            const cookie = createSessionTokenCookie('session-avatar-auth', authConfig, {
+                userId: 'u-avatar',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('GET', '/api/taskforce/auth/session', routes);
+            const req = createMockReq('GET', '/api/taskforce/auth/session', undefined, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.authenticated).toBe(true);
+            expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu-avatar%2Fprofile%2Favatar%2Fdraft.png');
+        });
+        it('POST /api/taskforce/auth/profile should save avatar by validated draft id', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            routes = createRoutes(core, { authConfig });
+            core.getUserAvatarUploadDraft.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: '2026-04-09T00:00:00.000Z',
+                discardedAt: null
+            });
+            core.resolveUserIdentity.mockReturnValueOnce({
+                userId: 'u1',
+                email: 'u1@example.com',
+                displayName: 'Before',
+                avatarUrl: null
+            });
+            core.updateUserProfile.mockReturnValueOnce({
+                userId: 'u1',
+                email: 'u1@example.com',
+                displayName: 'Updated Name',
+                avatarUrl: '/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png'
+            });
+            const cookie = createSessionTokenCookie('session-profile-auth', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile', routes);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile', {
+                displayName: 'Updated Name',
+                avatarDraftId: 'avatar-draft-1'
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.updateUserProfile).toHaveBeenCalledWith('u1', {
+                displayName: 'Updated Name',
+                avatarUrl: '/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png'
+            });
+            expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
+                action: 'auth-profile-updated',
+                actorUserId: 'u1',
+                actorRole: 'member'
+            }));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.profile.avatarUrl).toBe('/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png');
+        });
+        it('POST /api/taskforce/auth/profile/avatar/init should create a signed avatar upload draft', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const routesWithStorage = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            const cookie = createSessionTokenCookie('session-avatar-init', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile/avatar/init', routesWithStorage);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile/avatar/init', {
+                originalName: 'headshot.png',
+                mimeType: 'image/png',
+                size: 1024
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(true);
+            expect(payload.draftId).toMatch(/^avatar-draft-/);
+            expect(payload.relativePath).toMatch(/^users\/u1\/profile\/avatar\/avatar-draft-[a-f0-9]{32}-headshot\.png$/);
+            expect(payload.uploadUrl).toContain('X-Amz-Signature=');
+            expect(core.createUserAvatarUploadDraft).toHaveBeenCalledWith(expect.objectContaining({
+                userId: 'u1',
+                draftId: payload.draftId,
+                storageKey: payload.relativePath,
+                mimeType: 'image/png'
+            }));
+        });
+        it('POST /api/taskforce/auth/profile/avatar/finalize should validate and finalize the uploaded draft', async () => {
+            const authConfig = {
+                runtimeMode: 'cloud',
+                enabled: true,
+                requiredForApi: true,
+                excludedPaths: ['/api/taskforce/health', '/api/taskforce/auth'],
+                defaultRole: 'member',
+                defaultWorkspaceId: 'default',
+                sessionCookieName: 'taskforce_session',
+                sessionSecret: 'test-secret',
+                sessionTtlSeconds: 3600
+            };
+            const fetchMock = vi.fn().mockResolvedValue({
+                ok: true,
+                status: 200,
+                statusText: 'OK',
+                headers: { get: () => 'image/png' },
+                arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer
+            });
+            vi.stubGlobal('fetch', fetchMock);
+            const routesWithStorage = createRoutes(core, {
+                authConfig,
+                objectStorage: {
+                    provider: 'r2',
+                    r2: {
+                        accountId: 'acct-1',
+                        bucket: 'taskforce-docs',
+                        endpoint: 'https://example.r2.cloudflarestorage.com',
+                        accessKeyId: 'access-key-1',
+                        secretAccessKey: 'secret-key-1',
+                        keyPrefix: 'taskforce',
+                        signedUploadTtlSeconds: 600,
+                        signedDownloadTtlSeconds: 300
+                    }
+                }
+            });
+            core.getUserAvatarUploadDraft.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: null,
+                discardedAt: null
+            });
+            core.markUserAvatarUploadDraftFinalized.mockReturnValueOnce({
+                draftId: 'avatar-draft-1',
+                userId: 'u1',
+                storageKey: 'users/u1/profile/avatar/avatar-draft-1-headshot.png',
+                finalizedAt: '2026-04-09T00:00:00.000Z',
+                discardedAt: null
+            });
+            const cookie = createSessionTokenCookie('session-avatar-finalize', authConfig, {
+                userId: 'u1',
+                role: 'member',
+                workspaceId: 'workspace-1'
+            });
+            const match = matchRoute('POST', '/api/taskforce/auth/profile/avatar/finalize', routesWithStorage);
+            const req = createMockReq('POST', '/api/taskforce/auth/profile/avatar/finalize', {
+                draftId: 'avatar-draft-1',
+                relativePath: 'users/u1/profile/avatar/avatar-draft-1-headshot.png'
+            }, { cookie });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload.success).toBe(true);
+            expect(payload.avatarUrl).toBe('/api/taskforce/context/users%2Fu1%2Fprofile%2Favatar%2Favatar-draft-1-headshot.png');
+            expect(core.markUserAvatarUploadDraftFinalized).toHaveBeenCalledWith('u1', 'avatar-draft-1');
+            vi.unstubAllGlobals();
+        });
         it('GET /api/taskforce/admin/system-users should require system admin role', async () => {
             const match = matchRoute('GET', '/api/taskforce/admin/system-users', routes);
             const req = createMockReq('GET', '/api/taskforce/admin/system-users', undefined, { 'x-taskforce-system-role': 'user' });
@@ -8701,13 +8976,116 @@ describe('Server Routes', () => {
             expect(payload.planId).toBe('collab');
             expect(payload.features['collaboration.invites'].allowed).toBe(true);
         });
+        it('GET /api/taskforce/account/team-management-access should return unified role and team plan access', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'default',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access', undefined, {
+                'x-taskforce-user-id': 'u1',
+                'x-taskforce-workspace-id': 'workspace-1',
+                'x-taskforce-role': 'owner'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.resolveUserAccess).toHaveBeenCalledWith('u1', 'default', 'member');
+            expect(core.getAccountEntitlementsPayload).toHaveBeenCalledWith({ userId: 'u1', workspaceId: 'default' });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'default',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true
+            });
+        });
+        it('GET /api/taskforce/account/team-management-access should fall back to the hinted workspace role when local access cannot resolve the cloud user id', async () => {
+            core.resolveUserAccess.mockReturnValueOnce(null);
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u-cloud',
+                'x-taskforce-workspace-role': 'owner'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(core.resolveUserAccess).toHaveBeenCalledWith('u-cloud', 'workspace-1', 'member');
+            expect(core.getAccountEntitlementsPayload).toHaveBeenCalledWith({ userId: 'u-cloud', workspaceId: 'workspace-1' });
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true
+            });
+        });
+        it('GET /api/taskforce/account/team-management-access should still resolve access when billing tables are unavailable', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'ok',
+                hasEntitlement: true,
+                canAccessApp: true,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: null,
+                entitlement: {
+                    state: 'active',
+                    planId: 'collab',
+                    planVersionId: 'collab-v1'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockReturnValueOnce({
+                state: 'active',
+                planId: 'collab',
+                features: {
+                    'collaboration.team_management': { allowed: true }
+                }
+            });
+            const baseDb = core.getDatabaseAdapter();
+            core.getDatabaseAdapter = vi.fn().mockReturnValue({
+                ...baseDb,
+                prepare: vi.fn((sql) => {
+                    if (sql.includes('FROM user_billing') || sql.includes('FROM plan_catalog')) {
+                        throw new Error('no such table');
+                    }
+                    return baseDb.prepare(sql);
+                })
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/team-management-access', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/team-management-access?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'team',
+                allowed: true,
+                gate: 'ok',
+                planSelectionRequired: false
+            });
+        });
         it('GET /api/taskforce/account/access-status should return pending plan-selection gate', async () => {
             core.getAccountAccessStatus.mockReturnValueOnce({
                 gate: 'plan_selection_required',
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -8733,7 +9111,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -8748,6 +9125,87 @@ describe('Server Routes', () => {
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"PLAN_SELECTION_REQUIRED"'));
         });
+        it('GET /api/taskforce/account/profile-summary should return checkout-pending recovery context', async () => {
+            core.resolveUserAccess.mockReturnValueOnce({
+                userId: 'u1',
+                workspaceId: 'workspace-1',
+                role: 'owner',
+                disabled: false,
+                betaAccess: true
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/profile-summary', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/profile-summary?workspaceId=workspace-1', undefined, {
+                'x-taskforce-user-id': 'u1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            const payload = JSON.parse(res.end.mock.calls[0][0]);
+            expect(payload).toMatchObject({
+                planId: 'pro',
+                planVersionId: 'pro-v1',
+                entitlementState: 'checkout_pending',
+                gate: 'checkout_pending',
+                message: 'Complete checkout to continue.',
+                billingConflictCode: null,
+                planSelectionRequired: false,
+                workspaceId: 'workspace-1',
+                workspaceRole: 'owner',
+                canManageWorkspace: true,
+                teamPlanMode: 'personal',
+                teamManagementAllowed: false
+            });
+        });
+        it('GET /api/taskforce/account/entitlements should surface checkout-pending gate when billing is not complete', async () => {
+            core.getAccountEntitlementsPayload.mockImplementationOnce(() => {
+                const error = new Error('Entitlement not found');
+                error.code = 'ENTITLEMENT_NOT_FOUND';
+                throw error;
+            });
+            core.getAccountAccessStatus.mockReturnValueOnce({
+                gate: 'checkout_pending',
+                hasEntitlement: true,
+                canAccessApp: false,
+                canAccessPlans: true,
+                planSelectionRequired: false,
+                message: 'Complete checkout to continue.',
+                entitlement: {
+                    accountId: 'u1',
+                    planId: 'pro',
+                    planVersionId: 'pro-v1',
+                    state: 'checkout_pending'
+                }
+            });
+            const match = matchRoute('GET', '/api/taskforce/account/entitlements', routes);
+            const req = createMockReq('GET', '/api/taskforce/account/entitlements', undefined, {
+                'x-taskforce-user-id': 'u1',
+                'x-taskforce-workspace-id': 'workspace-1'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, {});
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"CHECKOUT_PENDING"'));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"gate":"checkout_pending"'));
+        });
         it('GET /api/taskforce/config should block authenticated users who must select a plan first', async () => {
             const authConfig = {
                 runtimeMode: 'cloud',
@@ -8771,7 +9229,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'plan_selection_required',
                 planSelectionRequired: true,
                 message: 'Choose a plan to continue.',
                 entitlement: null
@@ -8810,7 +9267,6 @@ describe('Server Routes', () => {
                 hasEntitlement: false,
                 canAccessApp: false,
                 canAccessPlans: true,
-                signupMonetizationStrategy: 'auto_assign_default',
                 planSelectionRequired: false,
                 message: 'No entitlement is linked to this account.',
                 entitlement: null
@@ -9403,6 +9859,64 @@ describe('Server Routes', () => {
             }));
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
         });
+        it('DELETE /api/taskforce/admin/system-users/:id should purge a user in allowed cloud environments', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            core.purgeSystemUser.mockReturnValue({
+                targetUserId: 'u1',
+                email: 'u1@example.com',
+                unassignedTaskCount: 2,
+                clearedInitiativeOwnerCount: 0,
+                clearedWorkstreamOwnerCount: 0,
+                deletedWorkspaceMembershipCount: 1,
+                deletedAuthTokenCount: 1,
+                deletedAvatarDraftCount: 0,
+                deletedMcpAccessTokenCount: 1,
+                deletedMcpOauthAuthCodeCount: 0,
+                deletedMcpOauthConnectorGrantCount: 0,
+                deletedUiStateCount: 1,
+                deletedUserPreferenceCount: 1,
+                deletedEntitlementCount: 1,
+                deletedUserBillingCount: 1,
+                deletedUserCount: 1
+            });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'performance-app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).toHaveBeenCalledWith({
+                targetUserId: 'u1',
+                actorUserId: 'admin-user',
+                emailConfirmation: 'u1@example.com'
+            });
+            expect(core.addAdminAuditLog).toHaveBeenCalledWith(expect.objectContaining({
+                action: 'purge-system-user',
+                actorRole: 'system_admin',
+                workspaceId: 'system'
+            }));
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+        });
+        it('DELETE /api/taskforce/admin/system-users/:id should reject production environment purges', async () => {
+            const authConfig = { runtimeMode: 'cloud', enabled: false };
+            routes = createRoutes(core, { authConfig });
+            const match = matchRoute('DELETE', '/api/taskforce/admin/system-users/u1', routes);
+            const req = createMockReq('DELETE', '/api/taskforce/admin/system-users/u1', { emailConfirmation: 'u1@example.com' }, {
+                'x-taskforce-system-role': 'system_admin',
+                'x-taskforce-user-id': 'admin-user',
+                host: 'app.taskforcehq.ai',
+                'x-forwarded-proto': 'https'
+            });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: 'u1' });
+            expect(core.purgeSystemUser).not.toHaveBeenCalled();
+            expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(expect.stringContaining('"code":"SYSTEM_USER_PURGE_ENVIRONMENT_FORBIDDEN"'));
+        });
         it('removed workspace-based plan route should not match', () => {
             expect(matchRoute('PATCH', '/api/taskforce/admin/workspace/plan', routes)).toBeNull();
             expect(matchRoute('GET', '/api/taskforce/workspace/assignee-options', routes)).not.toBeNull();
@@ -9720,7 +10234,7 @@ describe('Server Routes', () => {
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(403, expect.any(Object));
         });
-        it('GET /api/taskforce/admin/system-settings should include signup monetization fields', async () => {
+        it('GET /api/taskforce/admin/system-settings should include onboarding policy fields', async () => {
             core.getGlobalSettings.mockReturnValue({
                 auth: {
                     allowSelfRegistration: true,
@@ -9728,26 +10242,30 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
-            core.getSignupMonetizationSettings.mockReturnValue({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            core.getOnboardingPolicy.mockReturnValue({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             const match = matchRoute('GET', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('GET', '/api/taskforce/admin/system-settings', undefined, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             const payload = JSON.parse(res.end.mock.calls[0][0]);
-            expect(payload.status.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.status.defaultSignupPlanVersionId).toBe('starter-v1');
-            expect(payload.settings.signupMonetizationStrategy).toBe('auto_assign_default');
-            expect(payload.settings.defaultSignupPlanVersionId).toBe('starter-v1');
+            expect(payload.status.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.status.onboardingPlanVersionId).toBe('starter-v1');
+            expect(payload.settings.onboardingPolicyMode).toBe('auto_grant_free');
+            expect(payload.settings.onboardingPlanVersionId).toBe('starter-v1');
         });
-        it('POST /api/taskforce/admin/system-settings should persist signup monetization fields', async () => {
+        it('POST /api/taskforce/admin/system-settings should persist onboarding policy fields', async () => {
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
                 allowSelfRegistration: true,
@@ -9756,14 +10274,14 @@ describe('Server Routes', () => {
                 authRateLimitEnabled: true,
                 authRateLimitMaxRequests: 10,
                 authRateLimitWindowMs: 900000,
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: 'starter-v1'
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
-            expect(core.validateSignupMonetizationSettings).toHaveBeenCalledWith({
-                strategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: 'starter-v1'
+            expect(core.validateOnboardingPolicy).toHaveBeenCalledWith({
+                mode: 'auto_grant_free',
+                planVersionId: 'starter-v1'
             });
             expect(core.updateGlobalSettings).toHaveBeenCalledWith({
                 auth: {
@@ -9772,9 +10290,13 @@ describe('Server Routes', () => {
                     defaultNewUserBetaAccess: false,
                     authRateLimitEnabled: true,
                     authRateLimitMaxRequests: 10,
-                    authRateLimitWindowMs: 900000,
-                    signupMonetizationStrategy: 'auto_assign_default',
-                    defaultSignupPlanVersionId: 'starter-v1'
+                    authRateLimitWindowMs: 900000
+                },
+                billing: {
+                    onboardingPolicy: {
+                        mode: 'auto_grant_free',
+                        planVersionId: 'starter-v1'
+                    }
                 }
             });
         });
@@ -9883,23 +10405,25 @@ describe('Server Routes', () => {
             expect(res.end.mock.calls[0][0]).toContain('window.__TASKFORCE_SITE_CONFIG__ = ');
             expect(res.end.mock.calls[0][0]).toContain('"pricingPageEnabled":false');
         });
-        it('POST /api/taskforce/admin/system-settings should reject invalid signup monetization settings', async () => {
-            core.validateSignupMonetizationSettings.mockReturnValueOnce({
+        it('POST /api/taskforce/admin/system-settings should reject invalid onboarding settings', async () => {
+            core.validateOnboardingPolicy.mockReturnValueOnce({
                 valid: false,
-                code: 'SIGNUP_PLAN_VERSION_REQUIRED',
-                message: 'Default signup plan version is required when signup strategy is auto-assign default.'
+                code: 'ONBOARDING_PLAN_VERSION_REQUIRED',
+                message: 'An onboarding plan version is required for the selected onboarding mode.'
             });
             const match = matchRoute('POST', '/api/taskforce/admin/system-settings', routes);
             const req = createMockReq('POST', '/api/taskforce/admin/system-settings', {
-                signupMonetizationStrategy: 'auto_assign_default',
-                defaultSignupPlanVersionId: null
+                onboardingPolicyMode: 'auto_grant_free',
+                onboardingPlanVersionId: null
             }, { 'x-taskforce-role': 'admin' });
             const res = createMockRes();
             await match?.handler(req, res, {});
             expect(res.writeHead).toHaveBeenCalledWith(400, expect.any(Object));
             expect(core.updateGlobalSettings).not.toHaveBeenCalledWith(expect.objectContaining({
-                auth: expect.objectContaining({
-                    signupMonetizationStrategy: 'auto_assign_default'
+                billing: expect.objectContaining({
+                    onboardingPolicy: expect.objectContaining({
+                        mode: 'auto_grant_free'
+                    })
                 })
             }));
         });
@@ -10894,7 +11418,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith([newTask], {
                 atomic: true,
                 validateOnly: true,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -10949,7 +11474,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith(inputs, {
                 atomic: true,
                 validateOnly: false,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -11023,7 +11549,8 @@ describe('Server Routes', () => {
             expect(core.bulkCreateTasks).toHaveBeenCalledWith(inputs, {
                 atomic: true,
                 validateOnly: true,
-                workspaceId: 'default'
+                workspaceId: 'default',
+                provisionalLocalReference: true
             });
             expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
             expect(res.end).toHaveBeenCalledWith(JSON.stringify({
@@ -11044,6 +11571,36 @@ describe('Server Routes', () => {
                 errors: []
             }));
         });
+        it('PATCH /api/taskforce/task/:id should pass autosave updates through as non-audited route metadata', async () => {
+            const updatedTask = { id: '123', description: 'Draft body' };
+            core.updateTask.mockReturnValue(updatedTask);
+            const url = '/api/taskforce/task/123';
+            const match = matchRoute('PATCH', url, routes);
+            const req = createMockReq('PATCH', url, { description: 'Draft body', saveSource: 'autosave' });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: '123' });
+            expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Draft body' }, 'default', {
+                actorRef: 'user',
+                skipTaskEvents: true
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
+        });
+        it('PATCH /api/taskforce/task/:id should keep manual updates on the audited path', async () => {
+            const updatedTask = { id: '123', description: 'Manual body' };
+            core.updateTask.mockReturnValue(updatedTask);
+            const url = '/api/taskforce/task/123';
+            const match = matchRoute('PATCH', url, routes);
+            const req = createMockReq('PATCH', url, { description: 'Manual body', saveSource: 'manual' });
+            const res = createMockRes();
+            await match?.handler(req, res, { id: '123' });
+            expect(core.updateTask).toHaveBeenCalledWith('123', { description: 'Manual body' }, 'default', {
+                actorRef: 'user',
+                skipTaskEvents: false
+            });
+            expect(res.writeHead).toHaveBeenCalledWith(200, expect.any(Object));
+            expect(res.end).toHaveBeenCalledWith(JSON.stringify(updatedTask));
+        });
         it('PATCH /api/taskforce/task/:id should return rule-error status/message', async () => {
             core.updateTask.mockImplementation(() => {
                 const err = new Error('Task update blocked by rule check');