diff --git a/.deploy/mta.yaml b/.deploy/mta.yaml
index 1463ec2ad..dba6a1444 100644
--- a/.deploy/mta.yaml
+++ b/.deploy/mta.yaml
@@ -10,7 +10,7 @@ ID: tutorials-ims
 # Bump this on each release you deploy — it's the version shown by `cf mtas`
 # and in the mtar filename (tutorials-ims_<version>.mtar). Deploy is manual:
 # `cd .deploy && mbt build && cf deploy mta_archives/tutorials-ims_<version>.mtar -e ../deploy/<env>.mtaext -f`.
-version: 1.20.1
+version: 1.21.0
 
 # Top-level parameters (overridable per-env via deploy/<env>.mtaext).
 parameters:
@@ -172,7 +172,7 @@ modules:
         - cp -r ../../hugo/assets  ./hugo/assets
         - cp -r ../../hugo/data    ./hugo/data
         - cp -r ../../hugo/i18n    ./hugo/i18n
-        - bash -c "mkdir -p srv/jobs && mkdir -p srv/handlers && mkdir -p srv/lib/branch && mkdir -p srv/lib/runtime-config && mkdir -p srv/lib/prompts && mkdir -p srv/lib/kg && mkdir -p srv/mcp/prompts && cp ../../srv/lib/branch/condition.js ../../srv/lib/branch/engine.js ../../srv/lib/branch/ranker.js ../../srv/lib/branch/user-state.js ../../srv/lib/branch/loaders.js ../../srv/lib/branch/mission-detail.js ../../srv/lib/branch/slug-key.js ../../srv/lib/branch/decide.js ../../srv/lib/branch/joule-tool.js ../../srv/lib/branch/branch-telemetry.js ../../srv/lib/branch/group-by-alt.js ../../srv/lib/branch/profile-fields.js ../../srv/lib/branch/profile-override.js srv/lib/branch/ && cp ../../srv/lib/runtime-config/kg-settings.js ../../srv/lib/runtime-config/ui-events-settings.js ../../srv/lib/runtime-config/search-settings.js ../../srv/lib/runtime-config/navigator-settings.js ../../srv/lib/runtime-config/display-settings.js ../../srv/lib/runtime-config/tenant-settings.js ../../srv/lib/runtime-config/alert-settings.js srv/lib/runtime-config/ && cp ../../srv/lib/kg/on-demand-enqueue.js ../../srv/lib/kg/on-demand-cosine-rank.js srv/lib/kg/ && cp ../../srv/lib/credstore.js ../../srv/lib/secret-resolver.js ../../srv/lib/content-store.js ../../srv/lib/content-delta-flags.js ../../srv/lib/content-cache-coherence.js ../../srv/lib/edge-cache-headers.js ../../srv/lib/content-publish-session.js ../../srv/lib/resolve-tutorial-author.js ../../srv/lib/_tutorials-table.js ../../srv/lib/catalog-renderer.js ../../srv/lib/catalog-data.js ../../srv/lib/catalog-mission-hierarchy.js ../../srv/lib/chrome-shell.js ../../srv/lib/pipeline-log.js ../../srv/lib/legacy-id.js ../../srv/lib/embedding-pipeline.js ../../srv/lib/step-text-extractor.js ../../srv/lib/embedding-client.js ../../srv/lib/step-vectors.js ../../srv/lib/user-progress.js ../../srv/lib/co-completion.js ../../srv/lib/tutorial-centroid.js ../../srv/lib/tag-label-map.js ../../srv/lib/code-check-tool.js ../../srv/lib/code-check-prompt.js ../../srv/lib/code-check-handler.js ../../srv/lib/code-check-llm.js ../../srv/lib/code-check-step-loader.js ../../srv/lib/code-check-spec-publish.js ../../srv/lib/validate-answer-spec-publish.js ../../srv/lib/category-classifier.js ../../srv/lib/category-classifier-llm.js ../../srv/lib/category-seed-embeddings.js ../../srv/lib/build-catalog-categories.js ../../srv/lib/chat-settings-resolver.js ../../srv/lib/kg-extract.js ../../srv/lib/kg-queries.js ../../srv/lib/kg-projection.js ../../srv/lib/kg-similarity.js ../../srv/lib/kg-cycles.js ../../srv/lib/kg-graph-rebuild.js ../../srv/lib/kg-sparql-client.js ../../srv/lib/kg-merge-pair.js ../../srv/lib/kg-concept-loader.js ../../srv/lib/kg-neighborhood-cache.js ../../srv/lib/kg-neighborhood-merge.js ../../srv/lib/kg-neighborhood-full-helpers.js ../../srv/lib/kg-other-resources-loader.js ../../srv/lib/kg-stamp-meta-text.js ../../srv/lib/kg-tutorial-teaches-map.js ../../srv/lib/kg-resource-type-config.js ../../srv/lib/kg-meta-formatters.js ../../srv/lib/discovery-mission-categories.js ../../srv/lib/external-content-ttl.js ../../srv/lib/recompute-tutorial-progress-bulk-sql.js ../../srv/lib/youtube-fetcher.js ../../srv/lib/homepage-events-merger.js ../../srv/lib/homepage-rss-fetcher.js ../../srv/lib/rss-parse.js ../../srv/lib/community-blogs-fetcher.js ../../srv/lib/community-blog-source-defaults.js ../../srv/lib/community-blogs-classifier.js ../../srv/lib/safe-fetch.js ../../srv/lib/curl-transport.js ../../srv/lib/khoros-transport.js ../../srv/lib/explainer-generator.js ../../srv/lib/_token-cost.js ../../srv/lib/metrics.js ../../srv/lib/alerting.js ../../srv/lib/relevance-classifier.js ../../srv/lib/relevance-seed-embeddings.js ../../srv/lib/relevance-keyword-rules.js ../../srv/lib/canonicalize-link.js ../../srv/lib/detect-language-en.js ../../srv/lib/kg-community-coverage.js ../../srv/lib/page-key-map.js ../../srv/lib/page-fallback.js ../../srv/lib/task-record-submission-id.js ../../srv/lib/image-store.cjs ../../srv/lib/image-ingest.cjs ../../srv/lib/image-source-handler.js ../../srv/lib/img-cdn-fetch.cjs ../../srv/lib/img-cdn-retry.cjs ../../srv/lib/image-warm-utils.js ../../srv/lib/attachment-store.cjs ../../srv/lib/attachment-ingest.cjs ../../srv/lib/attachment-mime.cjs ../../srv/lib/attachment-warm-utils.js ../../srv/lib/attachment-source-handler.js ../../srv/lib/attachment-ingest-handler.js ../../srv/lib/island-manifest.json srv/lib/ && mkdir -p srv/lib/feature-flags && cp ../../srv/lib/feature-flags/db-flags.js ../../srv/lib/feature-flags/registry.js srv/lib/feature-flags/ && cp ../../srv/handlers/categories-after-hooks.js ../../srv/handlers/completion-path-items-altgroup.js srv/handlers/ && mkdir -p srv && cp ../../srv/content-moderation-service.js srv/ && cp ../../srv/jobs/consolidate-concepts-job.js ../../srv/jobs/extract-concepts-job.js ../../srv/jobs/job-lock.js ../../srv/jobs/secret-expiry-check.js ../../srv/jobs/homepage-link-health.js ../../srv/jobs/kg-ondemand-job.js ../../srv/jobs/community-blogs-fetch-job.js ../../srv/jobs/community-blogs-classify-job.js ../../srv/jobs/fetch-news-job.js srv/jobs/ && cp ../../srv/lib/prompts/explainer-verb.md ../../srv/lib/prompts/explainer-shelf.md ../../srv/lib/prompts/explainer-shelf-entry.md ../../srv/lib/prompts/community-blogs-classifier.md srv/lib/prompts/ && cp ../../srv/mcp/prompts/summarize_mission_for_beginner.md ../../srv/mcp/prompts/generate_lab_exercise.md ../../srv/mcp/prompts/explain_concept.md ../../srv/mcp/prompts/suggest_learning_path.md srv/mcp/prompts/"
+        - bash -c "mkdir -p srv/jobs && mkdir -p srv/handlers && mkdir -p srv/lib/branch && mkdir -p srv/lib/runtime-config && mkdir -p srv/lib/prompts && mkdir -p srv/lib/kg && mkdir -p srv/mcp/prompts && cp ../../srv/lib/branch/condition.js ../../srv/lib/branch/engine.js ../../srv/lib/branch/ranker.js ../../srv/lib/branch/user-state.js ../../srv/lib/branch/loaders.js ../../srv/lib/branch/mission-detail.js ../../srv/lib/branch/slug-key.js ../../srv/lib/branch/decide.js ../../srv/lib/branch/joule-tool.js ../../srv/lib/branch/branch-telemetry.js ../../srv/lib/branch/group-by-alt.js ../../srv/lib/branch/profile-fields.js ../../srv/lib/branch/profile-override.js srv/lib/branch/ && cp ../../srv/lib/runtime-config/kg-settings.js ../../srv/lib/runtime-config/ui-events-settings.js ../../srv/lib/runtime-config/search-settings.js ../../srv/lib/runtime-config/navigator-settings.js ../../srv/lib/runtime-config/display-settings.js ../../srv/lib/runtime-config/tenant-settings.js ../../srv/lib/runtime-config/alert-settings.js srv/lib/runtime-config/ && cp ../../srv/lib/kg/on-demand-enqueue.js ../../srv/lib/kg/on-demand-cosine-rank.js srv/lib/kg/ && cp ../../srv/lib/credstore.js ../../srv/lib/secret-resolver.js ../../srv/lib/content-store.js ../../srv/lib/content-delta-flags.js ../../srv/lib/content-cache-coherence.js ../../srv/lib/edge-cache-headers.js ../../srv/lib/content-publish-session.js ../../srv/lib/resolve-tutorial-author.js ../../srv/lib/_tutorials-table.js ../../srv/lib/catalog-renderer.js ../../srv/lib/catalog-data.js ../../srv/lib/catalog-mission-hierarchy.js ../../srv/lib/chrome-shell.js ../../srv/lib/pipeline-log.js ../../srv/lib/legacy-id.js ../../srv/lib/embedding-pipeline.js ../../srv/lib/step-text-extractor.js ../../srv/lib/embedding-client.js ../../srv/lib/step-vectors.js ../../srv/lib/user-progress.js ../../srv/lib/co-completion.js ../../srv/lib/tutorial-centroid.js ../../srv/lib/tag-label-map.js ../../srv/lib/code-check-tool.js ../../srv/lib/code-check-prompt.js ../../srv/lib/code-check-handler.js ../../srv/lib/code-check-llm.js ../../srv/lib/code-check-step-loader.js ../../srv/lib/code-check-spec-publish.js ../../srv/lib/validate-answer-spec-publish.js ../../srv/lib/category-classifier.js ../../srv/lib/category-classifier-llm.js ../../srv/lib/category-seed-embeddings.js ../../srv/lib/build-catalog-categories.js ../../srv/lib/chat-settings-resolver.js ../../srv/lib/kg-extract.js ../../srv/lib/kg-queries.js ../../srv/lib/kg-projection.js ../../srv/lib/kg-similarity.js ../../srv/lib/kg-cycles.js ../../srv/lib/kg-graph-rebuild.js ../../srv/lib/kg-sparql-client.js ../../srv/lib/kg-merge-pair.js ../../srv/lib/kg-concept-loader.js ../../srv/lib/kg-neighborhood-cache.js ../../srv/lib/kg-neighborhood-merge.js ../../srv/lib/kg-neighborhood-full-helpers.js ../../srv/lib/kg-other-resources-loader.js ../../srv/lib/kg-stamp-meta-text.js ../../srv/lib/kg-tutorial-teaches-map.js ../../srv/lib/kg-resource-type-config.js ../../srv/lib/kg-meta-formatters.js ../../srv/lib/discovery-mission-categories.js ../../srv/lib/external-content-ttl.js ../../srv/lib/recompute-tutorial-progress-bulk-sql.js ../../srv/lib/youtube-fetcher.js ../../srv/lib/homepage-events-merger.js ../../srv/lib/homepage-rss-fetcher.js ../../srv/lib/rss-parse.js ../../srv/lib/community-blogs-fetcher.js ../../srv/lib/community-blog-source-defaults.js ../../srv/lib/community-blogs-classifier.js ../../srv/lib/safe-fetch.js ../../srv/lib/curl-transport.js ../../srv/lib/khoros-transport.js ../../srv/lib/explainer-generator.js ../../srv/lib/_token-cost.js ../../srv/lib/metrics.js ../../srv/lib/alerting.js ../../srv/lib/relevance-classifier.js ../../srv/lib/relevance-seed-embeddings.js ../../srv/lib/relevance-keyword-rules.js ../../srv/lib/canonicalize-link.js ../../srv/lib/detect-language-en.js ../../srv/lib/kg-community-coverage.js ../../srv/lib/page-key-map.js ../../srv/lib/page-fallback.js ../../srv/lib/task-record-submission-id.js ../../srv/lib/image-store.cjs ../../srv/lib/image-ingest.cjs ../../srv/lib/image-source-handler.js ../../srv/lib/img-cdn-fetch.cjs ../../srv/lib/img-cdn-retry.cjs ../../srv/lib/image-warm-utils.js ../../srv/lib/attachment-store.cjs ../../srv/lib/attachment-ingest.cjs ../../srv/lib/attachment-mime.cjs ../../srv/lib/attachment-warm-utils.js ../../srv/lib/attachment-source-handler.js ../../srv/lib/attachment-ingest-handler.js ../../srv/lib/contributors-publish.js ../../srv/lib/validation-rules-publish.js ../../srv/lib/island-manifest.json srv/lib/ && mkdir -p srv/lib/feature-flags && cp ../../srv/lib/feature-flags/db-flags.js ../../srv/lib/feature-flags/registry.js srv/lib/feature-flags/ && cp ../../srv/handlers/categories-after-hooks.js ../../srv/handlers/completion-path-items-altgroup.js srv/handlers/ && mkdir -p srv && cp ../../srv/content-moderation-service.js srv/ && cp ../../srv/jobs/consolidate-concepts-job.js ../../srv/jobs/extract-concepts-job.js ../../srv/jobs/job-lock.js ../../srv/jobs/secret-expiry-check.js ../../srv/jobs/homepage-link-health.js ../../srv/jobs/kg-ondemand-job.js ../../srv/jobs/community-blogs-fetch-job.js ../../srv/jobs/community-blogs-classify-job.js ../../srv/jobs/fetch-news-job.js srv/jobs/ && cp ../../srv/lib/prompts/explainer-verb.md ../../srv/lib/prompts/explainer-shelf.md ../../srv/lib/prompts/explainer-shelf-entry.md ../../srv/lib/prompts/community-blogs-classifier.md srv/lib/prompts/ && cp ../../srv/mcp/prompts/summarize_mission_for_beginner.md ../../srv/mcp/prompts/generate_lab_exercise.md ../../srv/mcp/prompts/explain_concept.md ../../srv/mcp/prompts/suggest_learning_path.md srv/mcp/prompts/"
         - bash -c "node -e \"const p=require('./package.json'); p.dependencies=Object.assign(p.dependencies||{},{cheerio:'^1.2.0','@sap-ai-sdk/foundation-models':'^2.10.0'}); require('fs').writeFileSync('./package.json', JSON.stringify(p,null,2));\""
     properties:
       EXPOSE_CAP_UI: false
diff --git a/.github/workflows/notify-qa.yml.template b/.github/workflows/notify-qa.yml.template
index 6556984e6..7c05c2063 100644
--- a/.github/workflows/notify-qa.yml.template
+++ b/.github/workflows/notify-qa.yml.template
@@ -2,6 +2,16 @@
 name: Notify tutorials-qa
 on:
   push:
+    # -Contribution repos are a MIXTURE of default branches: most default to
+    # `main`, but Tutorials-Contribution still defaults to `master`. List BOTH
+    # so this fires ONLY on the repo's default branch — and NEVER on feature
+    # branches. Without this filter a push to any branch (e.g. the devtoberfest
+    # validation-tutorial bot's `validation-tutorial/*` branches) dispatches a
+    # QA rebuild for a slug that exists only on that branch; QA discovery reads
+    # the default branch, so the slug is a phantom and the rebuild hard-fails
+    # "unknown slug in filter" (tutorials-ims#2097). Mirrors the branch filter
+    # in docs/authors/tutorial-repo-dispatch.yml (the PROD notify template).
+    branches: [master, main]
     paths:
       - 'tutorials/**'
 
@@ -17,8 +27,15 @@ jobs:
           changed=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} \
             | awk -F/ '/^tutorials\//{print $2}' | sort -u)
           count=$(echo "$changed" | wc -l)
+          # Only emit a slug when EXACTLY one tutorial changed AND it matches the
+          # strict slug charset (whole-value POSIX case match); anything else →
+          # empty slug → rebuild-content-qa.yml runs a full rebuild. Mirrors
+          # docs/authors/tutorial-repo-dispatch.yml.
           if [ "$count" = "1" ] && [ -n "$changed" ]; then
-            echo "slug=$changed" >> "$GITHUB_OUTPUT"
+            case "$changed" in
+              *[!a-z0-9-]* | -* ) echo "slug=" >> "$GITHUB_OUTPUT" ;;
+              *) echo "slug=$changed" >> "$GITHUB_OUTPUT" ;;
+            esac
           else
             echo "slug=" >> "$GITHUB_OUTPUT"
           fi
diff --git a/CLAUDE.md b/CLAUDE.md
index 659deac10..f9197520d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -108,62 +108,28 @@ Subsystem one-liners:
 
 - **Admin-UI changes need a FULL deploy + are bundle-gated** — the admin apps (`app/admin/*` + `app/admin-shell/`) are raw-copied into the approuter's `static/admin-ui/` by the MTA's approuter builder during `mbt build`. A `--skip-build` deploy (reuses a stale mtar), a module-scoped `cf deploy -m tutorials-srv`, or an mtar packaged before the change landed will silently ship a **stale admin UI** even though the fix is on `main` (this is why PR #1331/#1345's value-help fix looked "not deployed" on DEV). `npm run deploy` now runs **Step 3.5** (`scripts/check-shipped-admin-bundle.cjs`) which cracks the mtar and diffs the shipped admin component files against source, failing the deploy on drift. Rule: deploy admin-UI changes with a full `npm run deploy -- --env <env>` (NO `--skip-build`, NO `-m` scoping), and never bypass Step 3.5.
 
-## Top Gotchas (rest in [tutorials-ims-gotchas.md](docs/developers/reference/tutorials-ims-gotchas.md))
-
-- **Fresh worktree setup needs `npm run setup` after `npm install`** — global npmrc has `ignore-scripts=true`. Without it, `hugo-apps/node_modules` won't be populated and `better-sqlite3`'s native binding won't build. Symptoms: hugo-apps tests fail resolving `@mediapipe/tasks-vision`, `npm test` hangs.
-
-- **`ignore-scripts=true` silences `postbuild:apps` — build artifacts wired into it are NOT produced by local `npm run build:all`** — the global npmrc `ignore-scripts=true` (see above) means npm **lifecycle hooks never fire**. The `postbuild:apps` hook is where the #1604 island-fingerprint step (`build:island-manifest`, which writes `hugo/data/island_manifest.json`) and 8 static guards live. During a local `build:all`, none of them run. Symptom class: fresh JS/CSS **compiles** (Vite emits `navigator-<hash>.js`) but is **never referenced** — `hugo/layouts/partials/island-src.html` falls back to the unhashed `/js/<name>.js`, Hugo bakes the stale path, and the approuter ships old bundles sitting next to the new ones. **Merged fixes look "not deployed" even though the deploy succeeded.** CI dodges this because `deploy.yml`/`unit-tests.yml` run `npm run postbuild:apps` as an **explicit step** (see deploy.yml:217-223 comment). Fix (2026-08-10): `build:all` now calls `npm run build:island-manifest` **explicitly** (not via the hook), and `scripts/deploy-mta.cjs` Step 2.5 fails the deploy if `hugo/public/index.html` bakes only unhashed island paths while a Vite manifest exists. Rule: any build **artifact** (not just a guard) needed for a correct ship must be an explicit step in `build:all`, never left to a `post*`/`pre*` lifecycle hook.
-
-- **`build:page-fallback` is an explicit `build:all` step (NOT a lifecycle hook)** — `scripts/build-page-fallback.cjs` copies in-scope page snapshots from `hugo/public` into `srv/page-fallback/<key>.<ext>` after `build:hugo` runs. Because `ignore-scripts=true` silences all `pre*`/`post*` hooks (see above), it is wired as an explicit `npm run build:page-fallback` in the `build:all` chain, positioned right after `build:hugo`. If you add a new in-scope page to `IN_SCOPE_PAGES` in `srv/lib/page-key-map.js`, the snapshot is picked up automatically on the next full build. Snapshots are gitignored (`srv/page-fallback/*` except `.gitkeep`); the directory is committed empty and populated at build time.
-
-- **`hugo/content/tutorials/` is entirely generated** — Never edit; overwritten by `npm run fetch-tutorials`. Edit `scripts/parsers/` or source tutorials in `sap-tutorials` org.
-
-- **Group/Mission completions are rollup-derived (issue #1934)** — the CAP rewrite never carried over the legacy IMS TUTORIAL→GROUP→MISSION rollup, so GROUP/MISSION `TaskRecords` stopped being created at the 2026-08-10 cutover. `srv/lib/completion-rollup.js` recomputes parent group(s)/mission(s) after any TUTORIAL/PUZZLE/CHECKPOINT/PETOBERFEST completion — called from `_updateTutorialProgress`, `resetTutorialProgress`, the CHECKPOINT edge of `createTaskRecord` (developer-service), `puzzle-service`, and `petoberfest-upload`. Slot model: alt-groups (`#172`) collapse to one slot where **any branch satisfies**; a nested GROUP slot needs all its tutorials. Records key on `(user_ID, taskLegacyId=<Groups|Missions>.legacyId, taskType)` and are upserted (SELECT-then-UPDATE-or-INSERT) with `stampSubmissionId` so they carry the NGDS dedup key. NGDS auto-send fires on the → COMPLETED edge (GROUP/MISSION are the only NGDS-eligible rollup types). The orchestrator never throws into the completion tx. Backfill (post-cutover only): `scripts/backfill-group-mission-completions.mjs` (bulk, `--dry-run`/`--since`/`--user`, no NGDS send) then `scripts/backfill-ngds-send.mjs` (rate-limited, resumable via `ImsConfig 'ngds.backfill.cursor'`, honors env=prod + kill-switch + epoch + canonical-sapId; receiver dedups on `submissionIdCompleted`). Pre-cutover completions are intentionally NOT re-minted (legacy IMS credited them; the NGDS epoch guard suppresses them). `completion-rollup.js` is NOT a `content-store.js` dependency → no `srv-qa` `cp` entry needed.
-
-- **Never run `publish-content` from a workstation** — Use `gh workflow run rebuild-content.yml`. Workstation publishes skip CI validation; the server-side no-revert guard catches the worst stale-cache regressions but not everything.
-
-- **Tutorial slugs are lowercase canonical** — Hugo emits lowercase; read path 301-redirects mixed-case. Write path lowercases via `tutorialsTableInfo` helper. Never compare slugs to publish payload without `.toLowerCase()`. Mismatches manifest as "0 steps" on group SSR.
-
-- **`TutorialMeta` and `Tutorials/Missions/Groups` slugs are unique** — `@assert.unique.slug` + `@assert.unique.tutorial`. New write paths MUST upsert on slug (SELECT-then-UPDATE-or-INSERT). Canonical pattern at `srv/lib/content-publish-session.js:285` / `:349`. Hybrid tests guard.
-
-- **Never SELECT a HANA BLOB alongside metadata in a single CDS QL query** — LOB locators expire before consumption when mixed with non-BLOB columns. Use raw `db.run()` for BLOB retrieval on HANA (`srv/lib/content-store.js` + `srv/lib/embedding-query.js`). CDS QL works on SQLite for unit tests.
-
-- **`CONTENT_API_KEY` env var required** for `POST /content/publish` and `/content/rollback`. Missing → 401. Set locally when testing publish.
-
-- **Content served from mutable `ContentCurrent` (Option B, #2017 / Workstream D), not the old `ContentFiles` snapshot-per-version** — three env flags gate the migration, all default OFF, flip in order: `CONTENT_DELTA_WRITE_ENABLED` (publish dual-writes changed slugs → `ContentCurrent` + append-only `ContentHistory`, fail-safe) → **seed** via a full force rebuild (`-f mode=full -f force-publish=true` dual-writes all slugs; no separate migration) → `CONTENT_DELTA_READ_ENABLED` (serve/readers hit `ContentCurrent`, per-slug fallback to `ContentFiles`) → `CONTENT_DELTA_SKIP_CARRYFORWARD` (publish skips `carryForwardUnchanged` → **O(changed) publish**; rollback then **replays `ContentHistory`** into `ContentCurrent`, not clear+fallback). Measured DEV: publish commit ~62s→973ms (PROD carry-forward was ~95s @ 11k files). Serve source header `X-Content-Source: db-current` (ContentCurrent) vs `db` (legacy). Revert = flip `SKIP_CARRYFORWARD` off + `cf restart`. Flags in `srv/lib/feature-flags/registry.js`; readers via `resolveContentBlob` (`srv/lib/content-store.js`). LOB reads stay raw `db.run()`. Cutover cleanup (delete `carryForwardUnchanged` + `ContentFiles`) deferred to a release after PROD soak.
-
-- **GitHub Actions secret is `DISPATCH_TOKEN`, not `GITHUB_DISPATCH_TOKEN`** — GH reserves the `GITHUB_` prefix. The runtime env var is `GITHUB_DISPATCH_TOKEN`, read by `srv/lib/rebuild-trigger.js`.
-
-- **`rebuild-content.yml` auto-infers `mode=slug-targeted`** when a `slug` input is set — don't pass `-f mode=slug-targeted`. Wall-clock: catalog-only ~5min, slug-targeted ~2min, full ~10min.
-
-- **Alert saves do NOT trigger rebuilds** — Alerts are runtime-served. Cache-bust on save is the only freshness mechanism; up-to-60s admin-to-visitor delay expected.
-
-- **NGDS auto-send is PROD-only + DB-gated (double gate)** — automatic push of task completions to NGDS (badging/gamification) fires from `srv/lib/ngds-autosend.js#maybeAutoSendCompletion`, called at the two completion transition points in `srv/developer-service.js` (`_updateTutorialProgress` + `createTaskRecord`). Sends ONLY when BOTH gates pass: (1) CF `space_name==='prod'` (`resolveDeployEnvironment`, not spoofable headers) AND (2) `ImsConfig` key `ngds.autosend.enabled==='true'` (admin kill-switch via `AdminService.toggleNgdsAutoSend`; 60s flag cache, busted on toggle). Edge-only (fires on the transition → COMPLETED, never on repeat saves) and task-type-allowlisted to TUTORIAL/GROUP/MISSION (legacy parity — PUZZLE/PETOBERFEST/STEP never sent). Fails CLOSED (config read error → disabled) and never throws into the completion tx (a send fault queues in `NGDSFailedMessages` for the 2h retry job). Bulk recompute (raw HANA MERGE) + migration (raw SQL) bypass the service layer, so they cannot flood NGDS. Payload shape itself is the legacy `MessageModel` (#1473). Default OFF in every env; enable in PROD via the admin toggle. Status: `AdminService.getNgdsAutoSendConfig()` returns `{enabled, environment, effective}`.
-
-- **`@cap-js/ai` plugin (issue #959, PR 2 of 2)** — adopted for RPT-1 recommendations on `@Common.ValueList` fields. Auto-hooks every such field in Fiori draft-enabled admin UIs. Local `cds watch` uses `AICore-mocked` (no recommendations, zero AI Core quota); hybrid/production use `AICore-btp` against the `aicore` VCAP binding. Per-field opt-out: `@UI.RecommendationState: 0`. Reference: [docs/developers/reference/cap-ai-plugin.md](docs/developers/reference/cap-ai-plugin.md).
-
-- **`KG_PAGERANK_ENABLED` env var (issue #916)** — when `'true'`, `rankNeighborhood` in `srv/knowledge-graph-service.js` multiplicatively blends per-tutorial PageRank (`weight *= 1 + α × normPR`) into all three tutorial-targeted arms (`prerequisitesOf`, `sharedConcepts`, `whatToLearnNext`) and sorts `teaches` by concept-side PageRank. Default off. Scores recomputed nightly at 03:53 UTC by `srv/jobs/kg-pagerank-job.js` — PageRank runs in **Node.js** (not HANA GraphScript — that engine ships no PageRank primitive) over `KG_PG_VERTICES_V` + `KG_PG_EDGES_V`, materialized into `ConceptRank`/`TutorialRank` sidecars. Fail-opens on every fault path (missing sidecars, HANA hiccup, empty maps → multiplier collapses to 1.0). Toggle: `cf set-env tutorials-srv KG_PAGERANK_ENABLED true && cf restart tutorials-srv`. Blend strength via `KG_PAGERANK_ALPHA` (default `1.0` → weights grow at most 2×).
-
-- **`KG_WCC_ISOLATION_THRESHOLD` env var (issue #918)** — nightly `srv/jobs/kg-wcc-job.js` runs at 04:07 UTC and materializes rows into `KgIsolation` for concept + tutorial vertices whose weakly-connected-component size ≤ threshold. Default `1`; `0` empties the table on the next run (effectively disables the "Isolated" red-badge column on the admin Concepts + Tutorials LRs). Compute is Node.js union-find over `KG_PG_VERTICES_V` + `KG_PG_EDGES_V` — same reason as #916 that HANA GraphScript ships no WCC primitive (SCC yes, WCC no; enumerated by the #916 Task 0 probe). Fail-quiet at read time: the `after('READ')` decorators on `KnowledgeGraphService.Concepts` and `AdminService.Tutorials` catch any SELECT throw and leave `isolated` unset — Fiori renders `null` boolean as no badge. Toggle: `cf set-env tutorials-srv KG_WCC_ISOLATION_THRESHOLD 2 && cf restart tutorials-srv` (or `0` to disable).
-
-- **`KG_ONDEMAND_ENABLED` env var / `KnowledgeGraphSettings.onDemandExtractionEnabled` (issue #948)** — when `true`, `expandSearchConcepts` fire-and-forgets an enqueue on zero-seed queries; a new 2-minute cron `kg-ondemand-drain` cosine-ranks the corpus and extracts concepts from top-K tutorials via `extractConceptsFromTutorial`. Coalesces near-duplicate queries; per-user (default 3/hr) and global (default 20/hr) rate-limit caps. Default OFF. Env knobs: `KG_ONDEMAND_USER_MAX_PER_HOUR`, `KG_ONDEMAND_GLOBAL_MAX_PER_HOUR`, `KG_ONDEMAND_DRAIN_BATCH` (default 3), `KG_ONDEMAND_TUTORIALS_PER_REQ` (default 5), `KG_ONDEMAND_MAX_ATTEMPTS` (default 3). Admin surface: `/admin-ui/#kgOnDemand`. Drain uses try/finally to recover stuck RUNNING rows on UPDATE failure. Toggle: flip `KnowledgeGraphSettings.onDemandExtractionEnabled=true` at `/admin-ui/#kg-settings` (or `cf set-env tutorials-srv KG_ONDEMAND_ENABLED true && cf restart tutorials-srv`).
-
-- **KG community detection (issue #917)** — Louvain community detection over `KG_PG_WORKSPACE` runs nightly at 03:57 UTC (`srv/jobs/kg-communities-job.js`) via HANA GraphScript `Communities_Louvain` in `db/src/procedures/KG_LOUVAIN_GRAPH.hdbprocedure`. Memberships materialize into the `KgCommunity` sidecar (`db/knowledge-graph-communities.cds`). Admin surface: `/admin-ui/#kgCommunities` renders a FE List Report (aggregated summary) + Object Page over `AdminService.KgCommunities` and `AdminService.KgCommunityMembers`. `promoteCommunityToMission(communityId, missionSlug, title)` action (SuperAdmin-gated) drafts a `Missions` row + `CompletionPaths` + `CompletionPathItems` sorted `Tutorials.title ASC`, with `Missions.sourceKgCommunityId` set so already-promoted communities can be filtered out. Nightly job fail-opens; empty sidecar renders as FE "No data", never a 500. **No env flag** — tile is always visible to XSUAA `Tutorial.Author` scope (Task 10 skipped: no shell-config precedent). **DEV-only in v1**; PROD rollout deferred. Metrics: `kg_communities_{duration_ms,count,max_size,failures}`.
-
-- **HCQL protocol adapter (issue #995)** — CAP 10 beta feature. `@hcql` annotation on 9 read-heavy services (AdminService, AuthorService, AnalyticsService, ExportsService, ConsolidationService, KnowledgeGraphService, HomepageService, SearchService, DeveloperService) in `srv/hcql-enablement.cds` exposes each service at its existing OData URL to also accept CQN `SELECT` bodies (HCQL and OData share URLs; dispatch is by request-body shape). Auth inherited from existing `@readonly`/`@requires`. Writes intentionally unsupported (beta not stable cross-runtime). **Runtime hazard:** CAP 10.0.3 exits the process on malformed CQN — do not expose to untrusted clients until CAP hardens the adapter. Kill switch: delete `srv/hcql-enablement.cds`, `cds build --production`, redeploy. Full reference: [docs/developers/reference/hcql-support.md](docs/developers/reference/hcql-support.md).
-
-- **`KG_RETIRE_ORPHANS_ENABLED` / `KG_RETIRE_ORPHANS_AGE_DAYS` (issue #1115)** — nightly `srv/jobs/kg-retire-orphans-job.js` at 04:37 UTC flips `Concepts.status` ACTIVE→RETIRED for concepts with zero links across all 10 link tables and `firstSeenAt` older than `KG_RETIRE_ORPHANS_AGE_DAYS` (default 14). RETIRED falls out of every read path (all filter `status='ACTIVE'` positively). First-run retirement **ramps** rather than purging instantly (~1 concept on the first run, climbing toward the full zero-link backlog as each concept ages past the grace window) — because on current data all zero-link orphans were minted within the last ~7-22 days. Reversible: `cf set-env tutorials-srv KG_RETIRE_ORPHANS_ENABLED false` (off) or bulk `UPDATE Concepts SET status='ACTIVE' WHERE status='RETIRED'` (data revert). Companion fix: on-demand extraction (#948) is now **link-only** — it attaches existing concepts (0.7 floor) but never mints, and a re-proposed retired slug is reactivated in-tx by `kg-merge-on-write.js` (`retiredBySlug` + `action:'reactivated'`).
-
-- **KG community peers + community labeling (issue #1126)** — `communityPeersEnabled` on `ChatSettings` (default `false`) gates the `findCommunityPeers` Joule tool (`srv/lib/kg/joule-tool-community-peers.js`). When enabled, the tool accepts a `tutorial_slug`, looks up the anchor's `communityFingerprint` in `KgCommunity`, and returns sibling tutorials from the same Louvain cluster plus the LLM-generated cluster label from `KgCommunityLabel`. Nightly `kg-community-labels` job (`srv/jobs/kg-community-label-job.js`) runs at 04:12 UTC (after Louvain at 03:57) and LLM-names each community with ≥ 2 tutorials. Identity key is `communityFingerprint` (String(64)); skip-key is `memberSlugsHash` (SHA-256 of sorted slugs) — stable member sets incur zero LLM calls. Daily budget is `communityLabelLlmBudgetPerDay` on `ChatSettings` (default 50); a fresh install ramps the backlog over several nights. Fail-open per community; overall throw → scheduler chassis logs `FAILED`. Toggle: `communityPeersEnabled` is a `ChatSettings` column (NOT an env var — nothing reads a `KG_COMMUNITY_PEERS_ENABLED`), enabled by an Admin via `PATCH /admin/ChatSettings(<ID>)` on the AdminService singleton — the same entity the `/admin-ui/#joule` Joule Settings page edits (note that page's fixed field list does not yet surface this flag, so a direct PATCH is the enablement path until it is added). **DEV-only until PROD Louvain data verifies.** Metrics: `kg_community_label_{duration_ms,labeled,skipped,failures}`.
-
-- **`KG_COMMUNITY_WEIGHT` env var (issue #1171)** — when `> 0`, `SearchService.before('READ')` appends a SECOND additive rank term `+ KG_COMMUNITY_WEIGHT * (case slug when '<peer>' then 1.0 else 0 end)` alongside the existing concept-overlap `KG_WEIGHT` (#945). Peers are tutorials sharing a Louvain `communityFingerprint` (#917/#1126) with the top-`COMMUNITY_TOP_K` (5) concept-overlap hits. Default `0` (OFF) → `buildCommunityRankFragment` in `srv/lib/search-kg-signal.js` short-circuits before any DB fetch and the rank SQL is byte-identical to the #945 formula. **Only fires when `ChatSettings.searchKgRerankEnabled=true`** — the community term is computed inside the same `before('READ')` gate as the KG signal, so setting `KG_COMMUNITY_WEIGHT > 0` while KG rerank is off has no effect. Fail-open (any DB throw → term collapses to `''`). Membership fetched packet-safe (≤5 fingerprints `.in()`, members capped 200, filtered in Node — `cqn-where-in-hana-packet-cap`). Regression harness + churn report at `test/harness/community-rank-churn*`; do NOT enable in any env before the ON-vs-OFF churn is hand-reviewed. Toggle: `cf set-env tutorials-srv KG_COMMUNITY_WEIGHT 1.5 && cf restart tutorials-srv` (with `searchKgRerankEnabled=true`).
-
-- **`KG_COMMUNITY_COVERAGE_NUDGE_THRESHOLD` env var (issue #1172)** — the `after('READ','KgCommunities')` decorator in `srv/admin-service.js` computes, per community at read time, mission-coverage % + dominant published mission + orphan-tutorial count (helper: `srv/lib/kg-community-coverage.js`) and populates virtual fields on `AdminService.KgCommunities`. Coverage is **published-missions-only** and the % denominator is **tutorial members only** (concept/tag-only communities render N/A, not 0%). `coverageHigh` (`>= threshold`, default **70**) is the single server-computed flag driving both the LR criticality badge and the FE promote-time `MessageBox.warning` ("~X% already in <mission> — extend instead?") in `app/admin/kgCommunities/webapp/ext/KgCommunityActionsController.controller.js`. **Fail-quiet** in its own try/catch (separate from `topConceptSlugs`): any throw → warn-log, fields unset, no badge, never a 500 (mirrors #918). No new job/table/migration — computed live. Packet-safe: the covered-slug `.in()` is chunked at 500 ([[cqn-where-in-hana-packet-cap]]). SuperAdmin gate on `promoteCommunityToMission` unchanged; the nudge is advisory. Override: `cf set-env tutorials-srv KG_COMMUNITY_COVERAGE_NUDGE_THRESHOLD 80 && cf restart tutorials-srv`. DEV-only until the #1126 PROD Louvain rollout lands (no `KgCommunity` data in PROD → empty LR, no nudges).
-- **Cluster-level Q&A in Joule (issue #1173)** — `describeCommunity` Joule tool (`srv/lib/kg/joule-tool-describe-community.js`) answers "what's the AI cluster?" / "everything around RAP" by resolving a free-text topic to a labeled Louvain community. **LLM-side matching:** `communityCatalogLayer` in `srv/lib/chat-context.js` injects the labeled-cluster catalog (from `KgCommunityLabel`, cached ~5min, cap 40) into the learner system prompt **only when `communityPeersEnabled` is true**; the model passes the chosen label as `matched_label`, and `matchLabel` (`srv/lib/kg/community-label-match.js`, pure) does case-insensitive exact match + token-overlap fallback + ambiguity detection. Reuses the existing `communityPeersEnabled` flag (NO new flag/schema), the `community-peers-cards` SSE frame + `renderCommunityPeersCards` render path, and the extracted `resolveCommunityMembers` helper (`srv/lib/kg/community-members.js`, also used by `findCommunityPeers`). Fail-open throughout (never 500). **Gotcha:** `buildSystemPromptLines` in `chat-orchestrator.js` is DEAD at runtime — `buildSystemPrompt` (chat-context.js) never calls it; the live guidance ships via `communityCatalogLayer`. DEV-only until PROD Louvain data verifies (same posture as #1126).
-- **`test:e2e` is post-deploy only, not on PRs** — the five Playwright admin-UI specs (issue #1338) run in the `e2e` CI job after `smoke-test`. They self-skip when `SMOKE_BASE_URL`/`PLAYWRIGHT_BASE_URL` is absent so `npm test` is never affected. Auth uses `SMOKE_TECH_USER`/`SMOKE_TECH_PASSWORD` (same secrets as smoke) via Basic auth against the approuter — verified against current main; the XSUAA routes short-circuit their IDP redirect for a provisioned tech user. Runbook: `test/e2e/README.md`. Selector gotcha: served tutorials render `<main>`+`<h1>`, NOT `<article>` — verified against DEV DOM on 2026-07-27.
-
-- **cds-caching CDS-DB store + metrics (issue #1179 → re-enabled #1182 → metrics disabled #1215 → metrics re-enabled #1222)** — the shared `caching` service (`cds.requires.caching`) uses `store: "cds"` in the `[hybrid]`/`[production]` profiles (base stays `store: "memory"` for local `cds watch` + unit tests). Gives multi-instance CF coherence (a `deleteByTag` bust on one instance invalidates all). **`metrics.enabled` is ON again (#1222)** — #1215 disabled it because on cds-caching ≤2.0.1 it threw `Wrong input for INT type` on every HANA flush (the plugin read back the hourly row via a flattened table-name SELECT → UPPERCASE column keys → `existingHourly.hits` is `undefined` → `undefined + n = NaN` → hdb INT-bind throw), so counters never accumulated (22 hourly rows stuck at 0). **cds-caching 2.0.2 fixes it** ([mikezaschka/cds-caching#27](https://github.com/mikezaschka/cds-caching/issues/27)): readback via the resolved CSN entity (`SELECT.one.from(Metrics)`) + `Number(existingHourly.<col>) || 0` coercion in `StatisticsPersistenceManager.js`. Re-enable is **config-only** (one-way): the plugin auto-persists `METRICSENABLED=1` on connect when config says `enabled:true` (`CachingService.js:133-135`) — no manual SQL to turn it on (the #1215 *disable* needed a `UPDATE ...SET METRICSENABLED=0` because nothing writes it back to 0). After deploy, clear the stale zeroed rows once per env: `DELETE FROM "PLUGIN_CDS_CACHING_METRICS" WHERE "cache"='caching'` (+ `KEYMETRICS`). Guards: `test/unit/caching-metrics-enabled.test.js` (renamed from `-disabled`) + `test/hybrid/caching-cds-store-boot.test.js` now assert metrics ON. **#1179 crash history:** the first srv deploy carrying `store: "cds"` crash-looped on CF (`Duplicate definition of artifact`) and was reverted (PR #1207); #1182 re-enables it with the resolve-guard fix below. **CF resolve-guard fix (#1182), two required halves:** (1) the srv nodejs `build.task` `model` list also includes `cds-caching/db/cache-store` + `cds-caching/db/statistics`, baking the four `plugin.cds_caching.*` entities into `srv/csn.json` (+4 defs, 0 views lost); (2) `srv/lib/strip-precompiled-plugin-roots.js` (called at top of `srv/server.js`, after `cds.plugins`, before model resolve) strips the plugin's runtime `env.roots` push when a precompiled `srv/csn.json` is present — otherwise those 2 extra roots tip CF's `resolve.many(env.roots)` past `length===1`, re-merging every `requires[].model` onto the precompiled csn → crash. Gated on `srv/csn.json` existence: strips in CF production, no-op in hybrid `cds watch` (compiles from source) and dev/unit (`store:memory` pushes nothing). Baking alone or stripping alone is insufficient — both are load-bearing. Reproducible locally from `gen/srv` (not the source tree — that always collapses to the single csn). **Metrics HDI gotcha:** this project's **explicit `build.tasks` list in `.cdsrc.json` suppresses cds's auto-registration of the plugin's build task** — so the four tables (`CacheStore` + `Caches`/`Metrics`/`KeyMetrics`) do NOT emit unless you add them by hand: `{ "for": "cds-caching" }` (emits `CacheStore.hdbtable`) + `{ "for": "hana", "src": "db", "dest": "db", "options": { "model": ["cds-caching/db/statistics"] } }` (the 3 metrics tables — model must be `statistics`-only; adding `db` to a `db`-dest task's model drops all ~247 service `.hdbview`s). QA container (`tutorials-hana-qa`) intentionally gets none — srv-qa doesn't wire caching. Metrics OData management API deliberately NOT registered (write actions). Test harness: unit workers get a stable memory-store config via `cds_requires_caching_*` env vars in `vitest.config.ts` (NOT a setupFiles that imports `@sap/cds` — that installs getter-only `SELECT`/`INSERT` globals and breaks tests assigning `globalThis.SELECT`) to close the fork-pool boot race (#1177). Full reference: [docs/developers/reference/cds-caching-store.md](docs/developers/reference/cds-caching-store.md).
-
-- **User-facing UI changes want a committed e2e spec** — a per-PR unit test can't catch a cross-PR seam (that's how #1366's value-help widening shipped dead behind #1353's custom dialog; see #1371). Changing `app/admin/**`, `app/**/webapp/**`, `hugo/layouts/**`, or `hugo-apps/**` triggers an *advisory* PR nudge (`.github/workflows/e2e-coverage-nudge.yml`) to add/update a `test/e2e/` spec. It never blocks merge; the existing post-DEV-deploy `e2e` CI job is where coverage is actually exercised. Pattern: [docs/developers/reference/e2e-coverage-pattern.md](docs/developers/reference/e2e-coverage-pattern.md).
-
-- **Freshness detector grounding needs the corpus-embedding backfill** — the `checkFreshness`/`freshness-scan` engine cosine-searches `ApiDocs`/`Samples` embeddings. Those columns are populated by `srv/jobs/freshness-corpus-embedding-job.js` (nightly `17 3` + on-demand `runJob`). Until it runs in an env, grounding returns nothing and every API-obsolescence claim degrades to `confidence: Low` (fail-open, by design). LLM calls use the SAP AI SDK directly (`@sap-ai-sdk/orchestration`, forced tool-call), NOT `@cap-js/ai`; unit tests inject `globalThis.__FRESHNESS_TEST_IMPL__`. Bulk scan gated by `FRESHNESS_SCAN_ENABLED` (default OFF). **Tutorial markdown is sourced from `ContentFiles.sourceContent` via `getTutorialSource(slug)` in `srv/lib/content-store.js` — NOT from `Steps.description`** (Steps are never populated with step markdown; reading Steps would yield nothing). Findings carry a **global `codeBlockIndex`** across the whole-tutorial markdown — per-step attribution is deferred because the persisted source is not split per step.
+## Top Gotchas
+
+The load-bearing few. **Full detail for every relocated item → [tutorials-ims-gotchas.md](docs/developers/reference/tutorials-ims-gotchas.md)** ("Top Gotchas — full detail" section); items with their own reference doc link straight to it.
+
+- **Fresh worktree: run `npm run setup` after `npm install`** — global npmrc `ignore-scripts=true` skips native builds; without it `hugo-apps/node_modules` is empty and `better-sqlite3` won't build (tests hang / fail resolving `@mediapipe/tasks-vision`).
+- **`ignore-scripts=true` silences all `pre*`/`post*` hooks** — local `build:all` does NOT fire `postbuild:apps`; island-manifest + `build:page-fallback` are wired as explicit `build:all` steps. Rely on the hook and merged JS/CSS ships dead (unhashed island paths) → "not deployed" despite a green deploy. → gotchas.md "Build artifacts & lifecycle hooks".
+- **`hugo/content/tutorials/` is entirely generated** — never edit; `fetch-tutorials` overwrites. Edit `scripts/parsers/` or source repos.
+- **Group/Mission completions are rollup-derived (#1934)** — `srv/lib/completion-rollup.js` recomputes parents after any TUTORIAL/PUZZLE/CHECKPOINT/PETOBERFEST completion; upserts on `(user_ID, taskLegacyId, taskType)`; NOT a `content-store.js` dep. → gotchas.md "Completions rollup".
+- **Never run `publish-content` from a workstation** — use `gh workflow run rebuild-content.yml`; workstation publishes skip CI validation.
+- **Tutorial slugs are lowercase canonical** — always `.toLowerCase()` before comparing to publish payload; mismatch = "0 steps" on group SSR.
+- **`TutorialMeta` + `Tutorials/Missions/Groups` slugs are unique** — new write paths MUST upsert on slug (SELECT-then-UPDATE-or-INSERT); pattern at `srv/lib/content-publish-session.js:285`/`:349`.
+- **Never SELECT a HANA BLOB alongside metadata in one CDS QL query** — LOB locators expire; use raw `db.run()` (`srv/lib/content-store.js`, `srv/lib/embedding-query.js`). CDS QL is fine on SQLite unit tests.
+- **`CONTENT_API_KEY` env var required** for `POST /content/publish` + `/content/rollback` (missing → 401).
+- **Content served from mutable `ContentCurrent` (Option B, #2017)** — 3 env flags gate it (all default OFF, flip in order); rollback replays `ContentHistory`. Serve header `X-Content-Source: db-current` vs `db`. → gotchas.md "Content model — mutable ContentCurrent".
+- **GitHub Actions secret is `DISPATCH_TOKEN`** (GH reserves `GITHUB_`) — runtime var `GITHUB_DISPATCH_TOKEN`, read by `srv/lib/rebuild-trigger.js`.
+- **`rebuild-content.yml` auto-infers `mode=slug-targeted`** when `slug` is set — don't pass mode. Wall-clock: catalog ~5m, slug ~2m, full ~10m.
+- **Alert saves do NOT trigger rebuilds** — runtime-served; cache-bust on save only, up-to-60s delay.
+- **NGDS auto-send is PROD-only + DB-gated (double gate)** — fires only when CF `space_name==='prod'` AND `ImsConfig ngds.autosend.enabled==='true'`; edge-only, fails closed, never throws into the completion tx, allowlisted to TUTORIAL/GROUP/MISSION. → gotchas.md "NGDS auto-send".
+- **`@cap-js/ai` for RPT-1 ValueList recommendations (#959)** — `AICore-mocked` locally, `AICore-btp` in hybrid/prod; per-field opt-out `@UI.RecommendationState: 0`. Ref: [cap-ai-plugin.md](docs/developers/reference/cap-ai-plugin.md).
+- **Knowledge-graph feature flags (`KG_*`), all default OFF + DEV-only, all fail-open** — PageRank #916, WCC isolation #918, on-demand extraction #948, Louvain communities #917, orphan retirement #1115, community peers/labels #1126, community search weight #1171, coverage nudge #1172, cluster Q&A #1173. Toggles, nightly jobs, and fail-open specifics → gotchas.md "Knowledge graph feature flags".
+- **HCQL protocol adapter (#995, CAP 10 beta)** — `@hcql` on 9 read services accepts CQN `SELECT` bodies at existing OData URLs. **CAP 10.0.3 exits the process on malformed CQN — do not expose to untrusted clients.** Kill: delete `srv/hcql-enablement.cds` + rebuild. Ref: [hcql-support.md](docs/developers/reference/hcql-support.md).
+- **cds-caching CDS-DB store + metrics ON (#1222)** — `store:"cds"` in hybrid/prod, `memory` in base/unit. CF resolve-guard needs BOTH the baked csn entities AND `srv/lib/strip-precompiled-plugin-roots.js` (both load-bearing). Ref: [cds-caching-store.md](docs/developers/reference/cds-caching-store.md).
+- **User-facing UI changes want a committed e2e spec** — advisory PR nudge on `app/**`/`hugo/**` changes; real coverage runs in the post-DEV-deploy `e2e` job. Ref: [e2e-coverage-pattern.md](docs/developers/reference/e2e-coverage-pattern.md).
+- **`test:e2e` is post-deploy only, not on PRs** — self-skips without `SMOKE_BASE_URL`. Served tutorials render `<main>`+`<h1>`, NOT `<article>`. Runbook: `test/e2e/README.md`.
+- **Freshness detector grounding needs the corpus-embedding backfill** — until `srv/jobs/freshness-corpus-embedding-job.js` runs, every API-obsolescence claim degrades to `confidence: Low`. Tutorial source from `ContentFiles.sourceContent` via `getTutorialSource(slug)`, NOT `Steps.description`. → gotchas.md "Freshness detector".
diff --git a/app/admin-annotations.cds b/app/admin-annotations.cds
index caf86fb23..7d5a38e86 100644
--- a/app/admin-annotations.cds
+++ b/app/admin-annotations.cds
@@ -714,12 +714,14 @@ annotate AdminService.Tutorials with {
 
 annotate AdminService.TutorialContributors with {
   name  @Common.Label: 'Name';
+  login @Common.Label: 'GitHub';
   email @Common.Label: 'Email';
   role  @Common.Label: 'Role';
 };
 
 annotate AdminService.TutorialContributors with @UI.LineItem: [
   { Value: name },
+  { $Type: 'UI.DataFieldWithUrl', Value: login, Url: profileUrl, Label: 'GitHub' },
   { Value: email },
   { Value: role }
 ];
@@ -881,6 +883,19 @@ annotate AdminService.ValidateAnswerSpecs with @UI: {
   }
 };
 
+// TutorialValidationRules — all validation rules for a tutorial (step, question,
+// type, rule, AI-grading flag, correct answer). Joined via `validationRules` association.
+annotate AdminService.TutorialValidationRules with @(
+  UI.LineItem: [
+    { Value: stepNumber,   Label: 'Step' },
+    { Value: questionText,  Label: 'Question' },
+    { Value: questionType,  Label: 'Type' },
+    { Value: ruleType,      Label: 'Rule' },
+    { Value: aiGrading,     Label: 'AI-Graded' },
+    { Value: correctAnswer, Label: 'Correct Answer' }
+  ]
+);
+
 // CodeCheckSpecs — per-step code-check specs (goal + reference solution).
 // Joined via `codeCheckSpecs` association.
 annotate AdminService.CodeCheckSpecs with {
@@ -954,14 +969,23 @@ annotate AdminService.Tutorials with @UI: {
     { $Type: 'UI.ReferenceFacet', Label: 'Contributors', ID: 'ContributorsFacet', Target: 'contributors/@UI.LineItem' },
     { $Type: 'UI.ReferenceFacet', Label: 'Completion Stats', ID: 'CompletionStatsFacet',
       Target: 'completionStats/@UI.FieldGroup#Stats' },
-    { $Type: 'UI.ReferenceFacet', Label: 'Validation Questions', ID: 'ValidationSpecsFacet',
+    { $Type: 'UI.ReferenceFacet', Label: 'AI-Graded Validation', ID: 'ValidationSpecsFacet',
       Target: 'validationSpecs/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'All Validation Rules', ID: 'AllValidationRulesFacet',
+      Target: 'validationRules/@UI.LineItem' },
     { $Type: 'UI.ReferenceFacet', Label: 'Code-Check Specs', ID: 'CodeCheckSpecsFacet',
       Target: 'codeCheckSpecs/@UI.LineItem' },
     { $Type: 'UI.ReferenceFacet', Label: 'AI-Author Requests', ID: 'AiRequestsFacet',
       Target: 'aiRequests/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Freshness Reports', ID: 'FreshnessReportsFacet', Target: 'freshnessReports/@UI.PresentationVariant' },
     { $Type: 'UI.ReferenceFacet', ID: 'FreshnessFacet', Label: 'Freshness',
       Target: 'freshnessFindings/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Images', ID: 'MediaImagesFacet', Target: 'images/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Assets', ID: 'MediaAssetsFacet', Target: 'assets/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Knowledge Graph', ID: 'KgFieldsFacet', Target: '@UI.FieldGroup#KnowledgeGraph' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Concepts Taught', ID: 'ConceptsTaughtFacet', Target: 'conceptLinks/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Co-Completed', ID: 'CoCompletionsFacet', Target: 'coCompletions/@UI.LineItem' },
+    { $Type: 'UI.ReferenceFacet', Label: 'Community', ID: 'KgCommunityFacet', Target: 'communityMembership/@UI.LineItem' },
     { $Type: 'UI.CollectionFacet', ID: 'Feedback', Label: 'Feedback', Facets: [
       { $Type: 'UI.ReferenceFacet', ID: 'FeedbackSummary',
         Target: 'feedbackSummary/@UI.FieldGroup#FeedbackSummary',
@@ -4348,6 +4372,20 @@ annotate AdminService.TopicClustersAdmin with @(
 
 // --- Tutorial Freshness Detector (spec 2026-08-22-tutorial-freshness-detector) ---
 // Surfaces per-finding analysis rows on the Tutorials Object Page and wires the
+// Freshness Reports — report-level header (spec 2026-08-31 task-5).
+// PresentationVariant sorts newest-first so the latest run appears at the top.
+annotate AdminService.FreshnessReport with @(
+  UI.LineItem: [
+    { Value: runAt,         Label: 'Run At' },
+    { Value: status,        Label: 'Status' },
+    { Value: model,         Label: 'Model' },
+    { Value: cost,          Label: 'Cost' },
+    { Value: openHighCount, Label: 'Open High' },
+    { Value: error,         Label: 'Error' }
+  ],
+  UI.PresentationVariant: { SortOrder: [{ Property: runAt, Descending: true }], Visualizations: ['@UI.LineItem'] }
+);
+
 // Set Disposition action. Criticality paths delegate to the virtual
 // `confidenceCriticality` field (computed by after('READ','FreshnessFinding')
 // in admin-service.js).
@@ -4378,3 +4416,75 @@ annotate AdminService.FreshnessFinding with {
   suggestedFix @UI.MultiLineText;
   evidence     @UI.MultiLineText;
 };
+
+// --- Media facets: TutorialImages + TutorialAssets (Task 4) ---
+annotate AdminService.TutorialImages with @(
+  UI.LineItem: [
+    { Value: thumbUrl, Label: 'Preview' },
+    { $Type: 'UI.DataFieldWithUrl', Value: viewUrl,   Url: viewUrl,   Label: 'Image (served)' },
+    { $Type: 'UI.DataFieldWithUrl', Value: sourceUrl, Url: sourceUrl, Label: 'Source (GitHub)' },
+    { Value: mimeType,    Label: 'Type' },
+    { Value: byteSize,    Label: 'Bytes' },
+    { Value: contentHash, Label: 'Hash' },
+    { Value: channel,     Label: 'Channel' }
+  ]
+) {
+  // Render thumbUrl inline as an image thumbnail rather than as raw text.
+  thumbUrl @UI.IsImageURL;
+};
+annotate AdminService.TutorialAssets with @(
+  UI.LineItem: [
+    { Value: filename,    Label: 'File' },
+    { $Type: 'UI.DataFieldWithUrl', Value: sourceUrl, Url: sourceUrl, Label: 'Source (GitHub)' },
+    { Value: mimeType,    Label: 'Type' },
+    { Value: byteSize,    Label: 'Bytes' },
+    { Value: contentHash, Label: 'Hash' }
+  ]
+);
+
+// --- Knowledge Graph facets (task-3) ---
+// TutorialConceptLinks LineItem: concept FK, predicate (teaches|extends), confidence score.
+annotate AdminService.TutorialConceptLinks with @(
+  UI.LineItem: [
+    { Value: concept_ID,  Label: 'Concept' },
+    { Value: predicate,   Label: 'Relation' },
+    { Value: confidence,  Label: 'Confidence' }
+  ]
+) {
+  // Show the human-readable concept name instead of the raw GUID FK.
+  // Annotate the association (not concept_ID) so the compiler propagates the
+  // text to the generated foreign key — mirrors the primaryTagRef precedent.
+  concept @Common.Text: concept.name @Common.TextArrangement: #TextOnly;
+};
+
+// CoCompletions LineItem: target tutorial slug + co-completion score.
+annotate AdminService.CoCompletions with @(
+  UI.LineItem: [
+    { Value: targetSlug, Label: 'Also Completed' },
+    { Value: score,      Label: 'Score' }
+  ]
+);
+
+// KgCommunityMembers LineItem: community (with LLM label) + member slug + type.
+annotate AdminService.KgCommunityMembers with @(
+  UI.LineItem: [
+    { Value: communityId, Label: 'Community' },
+    { Value: slug,        Label: 'Member' },
+    { Value: vertexType,  Label: 'Type' }
+  ]
+) {
+  // Prefix the numeric id with the LLM-generated cluster label when present
+  // (#1126); falls back to the bare id where labeling hasn't run yet.
+  communityId @Common.Text: labelInfo.label @Common.TextArrangement: #TextFirst;
+};
+
+// FieldGroup for PageRank score — shown in KgFieldsFacet on Tutorials OP.
+// rank is a to-one Association (slug-joined) added in task-1.
+annotate AdminService.Tutorials with @(
+  UI.FieldGroup #KnowledgeGraph: {
+    Label: 'Knowledge Graph',
+    Data: [
+      { $Type: 'UI.DataField', Value: rank.score, Label: 'PageRank Score' }
+    ]
+  }
+);
diff --git a/approuter/lib/search-redirect.js b/approuter/lib/search-redirect.js
new file mode 100644
index 000000000..ec41881da
--- /dev/null
+++ b/approuter/lib/search-redirect.js
@@ -0,0 +1,82 @@
+// approuter/lib/search-redirect.js
+//
+// 301-redirects the legacy `/search` entry point to this platform's canonical
+// tutorial finder at /tutorial-navigator/, preserving any query string.
+//
+// Background:
+//   The old site exposed a top-level /search page. That has been replaced by
+//   /tutorial-navigator/ (an SSR page served from HANA via CAP). External links
+//   and bookmarks to /search (and /search?q=…) must land on the navigator, with
+//   the user's query carried across so the navigator can pre-seed its filter.
+//
+//   Only the EXACT /search entry point redirects here — deeper /search/<path>
+//   URLs (e.g. the search JSON API) still proxy to srv-api via xs-app.json.
+//
+// Why middleware, not an xs-app.json route:
+//   @sap/approuter route config only rewrites+proxies or serves a localDir — it
+//   has no native 3xx-redirect verb. A prior attempt added `"status": 301` to an
+//   xs-app.json route; @sap/approuter v16 rejects that unknown property at boot
+//   (`xs-app.json/routes/<n>/status: Additional properties not allowed`), which
+//   crash-loops the approuter. A middleware in insertMiddleware.first is the same
+//   deterministic pattern used by sitemap-index-redirect.js / security-txt.js and
+//   runs BEFORE xs-app.json route matching, so /search/<path> (which this does
+//   NOT match) still proxies to srv-api untouched.
+//
+// Pure matcher + handler, both exported for the unit test. Approuter-native CJS
+// (like sitemap-index-redirect.js) — NOT copied from srv/lib.
+
+'use strict'
+
+// The exact legacy search entry point at the site root: /search or /search/,
+// optionally followed by a query string. Deliberately does NOT match deeper
+// /search/<path> URLs so those keep proxying to srv-api.
+const SEARCH_ENTRY_RE = /^\/search\/?$/
+
+const NAVIGATOR_PATH = '/tutorial-navigator/'
+
+/**
+ * Map the legacy /search entry point to /tutorial-navigator/, preserving the
+ * query string.
+ *
+ * /search            → /tutorial-navigator/
+ * /search/           → /tutorial-navigator/
+ * /search?q=cap      → /tutorial-navigator/?q=cap
+ * /search/?q=cap     → /tutorial-navigator/?q=cap
+ *
+ * Returns null for anything else — notably /search/<path> (the search API),
+ * which must keep proxying to srv-api.
+ *
+ * @param {string} url - path-or-path+query URL, e.g. '/search?q=cap'
+ * @returns {string | null} the navigator target for the /search entry point, else null
+ */
+function matchSearchUrl(url) {
+  if (typeof url !== 'string' || url.length === 0) return null
+  const qIdx = url.indexOf('?')
+  const pathname = qIdx === -1 ? url : url.slice(0, qIdx)
+  if (!SEARCH_ENTRY_RE.test(pathname)) return null
+  const query = qIdx === -1 ? '' : url.slice(qIdx) // includes the leading '?'
+  return NAVIGATOR_PATH + query
+}
+
+// Express-style middleware. Mount at path '/' in insertMiddleware.first, BEFORE
+// the static/proxy handlers so /search is answered here and never falls through
+// to the xs-app.json /search/<path> proxy route.
+function searchRedirectHandler(req, res, next) {
+  if (req.method !== 'GET' && req.method !== 'HEAD') return next()
+
+  const target = matchSearchUrl(req.url || '')
+  if (!target) return next()
+
+  res.writeHead(301, {
+    Location: target,
+    'Cache-Control': 'public, max-age=86400',
+  })
+  res.end()
+}
+
+module.exports = {
+  searchRedirectHandler,
+  // exported for the unit test
+  matchSearchUrl,
+  NAVIGATOR_PATH,
+}
diff --git a/approuter/server.js b/approuter/server.js
index 53dddde65..ecd775f22 100644
--- a/approuter/server.js
+++ b/approuter/server.js
@@ -25,6 +25,7 @@ const { mcpManifestHandler } = require('./lib/well-known-mcp-manifest')
 const { mcpAuthChallengeHandler } = require('./lib/mcp-auth-challenge')
 const { securityTxtHandler } = require('./lib/security-txt')
 const { sitemapIndexRedirectHandler } = require('./lib/sitemap-index-redirect')
+const { searchRedirectHandler } = require('./lib/search-redirect')
 const shouldProcessImage = require('./lib/img-cdn-should-process')
 const { buildImageOriginUrl } = require('./lib/img-cdn-origin')
 const { ImgCache } = require('./lib/img-cdn-cache')
@@ -597,6 +598,7 @@ ar.start({
           { path: '/', handler: mcpManifestHandler },
           { path: '/', handler: securityTxtHandler },
           { path: '/', handler: sitemapIndexRedirectHandler },
+          { path: '/', handler: searchRedirectHandler },
           { path: '/', handler: mcpAuthChallengeHandler },
           { path: '/', handler: devtoberfestCspHandler },
           { path: '/', handler: imgCdnHandler },
diff --git a/approuter/xs-app.json b/approuter/xs-app.json
index 0ed2cb08a..a802fa8ea 100644
--- a/approuter/xs-app.json
+++ b/approuter/xs-app.json
@@ -396,7 +396,7 @@
       "authenticationType": "none"
     },
     {
-      "source": "^/build/(breadcrumb-context|catalog|co-completions|concepts|homepage-shelves|kg-stats|mission|my-progress|navigator|repo-catalog|slug-mapping|tag-labels|topics-gallery)(/.*)?(\\?.*)?$",
+      "source": "^/build/(breadcrumb-context|catalog|co-completions|concepts|homepage-shelves|kg-stats|mission|my-progress|navigator|repo-catalog|slug-mapping|tag-labels|topics-gallery|topics-tree|topics)(/.*)?(\\?.*)?$",
       "target": "/build/$1$2$3",
       "destination": "srv-api",
       "authenticationType": "none"
@@ -582,7 +582,8 @@
       "cacheControl": "public, max-age=3600"
     },
     { "source": "^/browse/?(\\?.*)?$",              "target": "/content/pages/browse/$1",              "destination": "srv-api", "authenticationType": "none" },
-    { "source": "^/topics/?(\\?.*)?$",              "target": "/content/pages/topics/$1",              "destination": "srv-api", "authenticationType": "none" },
+    { "source": "^/topics/?(\\?.*)?$", "target": "/content/topics-index$1", "destination": "srv-api", "authenticationType": "none" },
+    { "source": "^/topics/(.*)$", "target": "/content/topics/$1", "destination": "srv-api", "authenticationType": "none" },
     { "source": "^/tutorial-navigator/?(\\?.*)?$",  "target": "/content/pages/tutorial-navigator/$1",  "destination": "srv-api", "authenticationType": "none" },
     { "source": "^/developer-advocates/?(\\?.*)?$", "target": "/content/pages/developer-advocates/$1", "destination": "srv-api", "authenticationType": "none" },
     { "source": "^/developer-advocates/([^/?]+)/?(\\?.*)?$", "target": "/content/developer-advocates/$1",   "destination": "srv-api", "authenticationType": "none" },
diff --git a/db/last-dev/csn.json b/db/last-dev/csn.json
index c574809bc..ea9751704 100644
--- a/db/last-dev/csn.json
+++ b/db/last-dev/csn.json
@@ -1075,6 +1075,21 @@
           "length": 50,
           "@cds.persistence.name": "ROLE"
         },
+        "login": {
+          "type": "cds.String",
+          "length": 255,
+          "@cds.persistence.name": "LOGIN"
+        },
+        "avatarUrl": {
+          "type": "cds.String",
+          "length": 1024,
+          "@cds.persistence.name": "AVATARURL"
+        },
+        "profileUrl": {
+          "type": "cds.String",
+          "length": 1024,
+          "@cds.persistence.name": "PROFILEURL"
+        },
         "user_ID": {
           "type": "cds.String",
           "length": 36,
@@ -1457,6 +1472,66 @@
       },
       "@cds.persistence.name": "COM_SAP_DEVELOPERS_IMS_DEVELOPERENVIRONMENTLINKS"
     },
+    "com.sap.developers.ims.TutorialValidationRules": {
+      "kind": "entity",
+      "@cds.persistence.journal": true,
+      "elements": {
+        "tutorial_ID": {
+          "type": "cds.String",
+          "length": 36,
+          "@odata.foreignKey4": "tutorial",
+          "key": true,
+          "@cds.persistence.name": "TUTORIAL_ID"
+        },
+        "stepNumber": {
+          "key": true,
+          "type": "cds.Integer",
+          "@cds.persistence.name": "STEPNUMBER"
+        },
+        "questionId": {
+          "key": true,
+          "type": "cds.String",
+          "length": 100,
+          "@cds.persistence.name": "QUESTIONID"
+        },
+        "questionText": {
+          "type": "cds.String",
+          "length": 2000,
+          "@cds.persistence.name": "QUESTIONTEXT"
+        },
+        "ruleType": {
+          "type": "cds.String",
+          "length": 50,
+          "@cds.persistence.name": "RULETYPE"
+        },
+        "questionType": {
+          "type": "cds.String",
+          "length": 20,
+          "@cds.persistence.name": "QUESTIONTYPE"
+        },
+        "choiceMode": {
+          "type": "cds.String",
+          "length": 20,
+          "@cds.persistence.name": "CHOICEMODE"
+        },
+        "options": {
+          "type": "cds.LargeString",
+          "@cds.persistence.name": "OPTIONS"
+        },
+        "correctAnswer": {
+          "type": "cds.LargeString",
+          "@cds.persistence.name": "CORRECTANSWER"
+        },
+        "aiGrading": {
+          "type": "cds.Boolean",
+          "default": {
+            "val": false
+          },
+          "@cds.persistence.name": "AIGRADING"
+        }
+      },
+      "@cds.persistence.name": "COM_SAP_DEVELOPERS_IMS_TUTORIALVALIDATIONRULES"
+    },
     "com.sap.developers.ims.Puzzles": {
       "kind": "entity",
       "@assert.unique.slug": [
diff --git a/db/persistence.cds b/db/persistence.cds
index 97d8c91c8..1ba6e23f8 100644
--- a/db/persistence.cds
+++ b/db/persistence.cds
@@ -50,3 +50,4 @@ annotate ims.CatGameAwards with @cds.persistence.journal;   // #2042 Hit-the-Cat
 // #805 — Observability
 annotate ims.MetricSnapshots with @cds.persistence.journal;
 annotate ims.PublishTimings with @cds.persistence.journal;
+annotate ims.TutorialValidationRules with @cds.persistence.journal;
diff --git a/db/schema.cds b/db/schema.cds
index 07ffce7df..e1d48af79 100644
--- a/db/schema.cds
+++ b/db/schema.cds
@@ -453,6 +453,9 @@ entity TutorialContributors : cuid, LegacyKeyed {
   name                      : String(255);
   email                     : String(255);
   role                      : String(50);
+  login                     : String(255);   // GitHub handle
+  avatarUrl                 : String(1024);  // https://github.com/<login>.png
+  profileUrl                : String(1024);  // https://github.com/<login>
   user                      : Association to Users;
 }
 
@@ -872,6 +875,23 @@ entity ValidateAnswerSpecs : managed {
   aiGrading         : Boolean default false;
 }
 
+// Full parsed rules.vr rule set for a tutorial, persisted at publish time.
+// Unlike ValidateAnswerSpecs (AI-graded only), this holds ALL rule types so
+// the admin Validation Questions facet can display the complete rule set.
+// options and correctAnswer are JSON-serialised; null when not applicable.
+entity TutorialValidationRules {
+  key tutorial     : Association to Tutorials;
+  key stepNumber   : Integer;
+  key questionId   : String(100);
+      questionText : String(2000);
+      ruleType     : String(50);   // single-choice | multiple-choice | regex | exact-match | ...
+      questionType : String(20);   // MCQ | TEXT
+      choiceMode   : String(20);   // single | multiple | null
+      options      : LargeString;  // JSON array of option strings (MCQ) or null
+      correctAnswer: LargeString;  // reference answer (client-graded) or null when aiGrading
+      aiGrading    : Boolean default false;
+}
+
 // Every learner submission. Drives offline grader-quality evaluation.
 // 'verdict' allows 'error' as a server-side outcome value (the LLM JSON
 // schema only emits 'pass' | 'partial' | 'fail').
diff --git a/db/src/ADVOCATE_VALUE_HELP_V1.hdbview b/db/src/ADVOCATE_VALUE_HELP_V1.hdbview
new file mode 100644
index 000000000..787d75aca
--- /dev/null
+++ b/db/src/ADVOCATE_VALUE_HELP_V1.hdbview
@@ -0,0 +1,21 @@
+-- Cross-container value-help view for the Devtoberfest planner's Session.host
+-- field (#2102). Exposes ACTIVE developer advocates as a suggestion list:
+-- a display NAME (firstName + ' ' + lastName), the name parts for OrderBy, the
+-- advocate TITLE, and the linked user's EMAIL for disambiguation.
+--
+-- All output columns are aliased UPPERCASE so the consumer synonym resolves
+-- (camelCase aliases pass this build but fail the consumer resolve with
+-- "invalid column name" — cross-container column-case rule).
+--
+-- Granted via tutorial_reader / tutorial_reader# (one role, many views).
+VIEW "ADVOCATE_VALUE_HELP_V1" AS
+  SELECT A."ID"                               AS "ID",
+         A."FIRSTNAME" || ' ' || A."LASTNAME" AS "NAME",
+         A."FIRSTNAME"                        AS "FIRSTNAME",
+         A."LASTNAME"                         AS "LASTNAME",
+         A."TITLE"                            AS "TITLE",
+         U."EMAIL"                            AS "EMAIL"
+  FROM "COM_SAP_DEVELOPERS_IMS_ADVOCATES" A
+  LEFT OUTER JOIN "COM_SAP_DEVELOPERS_IMS_USERS" U
+    ON A."USER_ID" = U."ID"
+  WHERE A."ISACTIVE" = TRUE
diff --git a/db/src/com.sap.developers.ims.TutorialContributors.hdbmigrationtable b/db/src/com.sap.developers.ims.TutorialContributors.hdbmigrationtable
index 4d27bb3be..8d7511e59 100644
--- a/db/src/com.sap.developers.ims.TutorialContributors.hdbmigrationtable
+++ b/db/src/com.sap.developers.ims.TutorialContributors.hdbmigrationtable
@@ -1,4 +1,4 @@
-== version=2
+== version=3
 COLUMN TABLE com_sap_developers_ims_TutorialContributors (
   ID NVARCHAR(36) NOT NULL,
   legacyId INTEGER,
@@ -6,10 +6,17 @@ COLUMN TABLE com_sap_developers_ims_TutorialContributors (
   name NVARCHAR(255),
   email NVARCHAR(255),
   role NVARCHAR(50),
+  login NVARCHAR(255),
+  avatarUrl NVARCHAR(1024),
+  profileUrl NVARCHAR(1024),
   user_ID NVARCHAR(36),
   PRIMARY KEY(ID)
 )
 
+== migration=3
+-- generated by cds-compiler version 7.0.1
+ALTER TABLE com_sap_developers_ims_TutorialContributors ADD (login NVARCHAR(255), avatarUrl NVARCHAR(1024), profileUrl NVARCHAR(1024));
+
 == migration=2
 -- generated by cds-compiler version 6.9.0
 ALTER TABLE com_sap_developers_ims_TutorialContributors ADD (user_ID NVARCHAR(36));
diff --git a/db/src/com.sap.developers.ims.TutorialValidationRules.hdbmigrationtable b/db/src/com.sap.developers.ims.TutorialValidationRules.hdbmigrationtable
new file mode 100644
index 000000000..99ba6938b
--- /dev/null
+++ b/db/src/com.sap.developers.ims.TutorialValidationRules.hdbmigrationtable
@@ -0,0 +1,14 @@
+== version=1
+COLUMN TABLE com_sap_developers_ims_TutorialValidationRules (
+  tutorial_ID NVARCHAR(36) NOT NULL,
+  stepNumber INTEGER NOT NULL,
+  questionId NVARCHAR(100) NOT NULL,
+  questionText NVARCHAR(2000),
+  ruleType NVARCHAR(50),
+  questionType NVARCHAR(20),
+  choiceMode NVARCHAR(20),
+  options NCLOB,
+  correctAnswer NCLOB,
+  aiGrading BOOLEAN DEFAULT FALSE,
+  PRIMARY KEY(tutorial_ID, stepNumber, questionId)
+)
diff --git a/db/src/tutorial_reader.hdbrole b/db/src/tutorial_reader.hdbrole
index a2f1b25b1..1fe21dd21 100644
--- a/db/src/tutorial_reader.hdbrole
+++ b/db/src/tutorial_reader.hdbrole
@@ -3,7 +3,8 @@
     "name": "tutorial_reader",
     "object_privileges": [
       { "name": "TUTORIAL_VALUE_HELP_V1", "type": "VIEW", "privileges": [ "SELECT" ] },
-      { "name": "TASK_VALUE_HELP_V1", "type": "VIEW", "privileges": [ "SELECT" ] }
+      { "name": "TASK_VALUE_HELP_V1", "type": "VIEW", "privileges": [ "SELECT" ] },
+      { "name": "ADVOCATE_VALUE_HELP_V1", "type": "VIEW", "privileges": [ "SELECT" ] }
     ]
   }
 }
diff --git a/db/src/tutorial_reader_grantable.hdbrole b/db/src/tutorial_reader_grantable.hdbrole
index 8cac93aad..e950dbe82 100644
--- a/db/src/tutorial_reader_grantable.hdbrole
+++ b/db/src/tutorial_reader_grantable.hdbrole
@@ -3,7 +3,8 @@
     "name": "tutorial_reader#",
     "object_privileges": [
       { "name": "TUTORIAL_VALUE_HELP_V1", "type": "VIEW", "privileges_with_grant_option": [ "SELECT" ] },
-      { "name": "TASK_VALUE_HELP_V1", "type": "VIEW", "privileges_with_grant_option": [ "SELECT" ] }
+      { "name": "TASK_VALUE_HELP_V1", "type": "VIEW", "privileges_with_grant_option": [ "SELECT" ] },
+      { "name": "ADVOCATE_VALUE_HELP_V1", "type": "VIEW", "privileges_with_grant_option": [ "SELECT" ] }
     ]
   }
 }
diff --git a/db/tutorial-assets.cds b/db/tutorial-assets.cds
index d030f5a54..a07a94de7 100644
--- a/db/tutorial-assets.cds
+++ b/db/tutorial-assets.cds
@@ -11,6 +11,7 @@ entity TutorialAssets {
       channel     : String(8);               // 'prod' | 'qa'
       contentHash : String(64);              // sha-256 of stored bytes
       mimeType    : String(128);
+      byteSize    : Integer64;               // original byte length captured at ingest
       filename    : String(255);             // for Content-Disposition
       content     : Composition of many Attachments;
 }
diff --git a/db/tutorial-images.cds b/db/tutorial-images.cds
index 91a2f799d..903da7199 100644
--- a/db/tutorial-images.cds
+++ b/db/tutorial-images.cds
@@ -12,5 +12,6 @@ entity TutorialImages {
       channel     : String(8);               // 'prod' | 'qa'
       contentHash : String(64);              // sha-256 of the stored original
       mimeType    : String(128);
+      byteSize    : Integer64;               // original byte length captured at ingest
       content     : Composition of many Attachments;
 }
diff --git a/docs/developers/reference/tutorials-ims-gotchas.md b/docs/developers/reference/tutorials-ims-gotchas.md
index 9fcb47ddc..bb4a08286 100644
--- a/docs/developers/reference/tutorials-ims-gotchas.md
+++ b/docs/developers/reference/tutorials-ims-gotchas.md
@@ -102,3 +102,48 @@ Cross-references:
 ## Tutorial Navigator
 
 - **Navigator "Featured" rail is curated via `/admin-ui/#/operations` → Featured Tasks** — draft CRUD (pick items by title via `FeaturedTaskCandidates` value-help, unique per item, order defaults to next integer); SSR from `browse.json`'s `featured[]` array (mission-curated or first-6-missions fallback when empty); live-rehydrated from `GET /build/featured` (ETag/304, 60s server cache, mixed tutorial/mission/group types); cache busts automatically on `FeaturedTasks` save/delete via `resetFeaturedCache()`.
+
+---
+
+# Top Gotchas — full detail (relocated from CLAUDE.md)
+
+These paragraphs used to live inline in `CLAUDE.md`'s "Top Gotchas" section. They were moved here verbatim to keep `CLAUDE.md` lean; the headline + load-bearing one-liner + a link back to this section remain in `CLAUDE.md`.
+
+## Build artifacts & lifecycle hooks
+
+- **`ignore-scripts=true` silences `postbuild:apps` — build artifacts wired into it are NOT produced by local `npm run build:all`** — the global npmrc `ignore-scripts=true` means npm **lifecycle hooks never fire**. The `postbuild:apps` hook is where the #1604 island-fingerprint step (`build:island-manifest`, which writes `hugo/data/island_manifest.json`) and 8 static guards live. During a local `build:all`, none of them run. Symptom class: fresh JS/CSS **compiles** (Vite emits `navigator-<hash>.js`) but is **never referenced** — `hugo/layouts/partials/island-src.html` falls back to the unhashed `/js/<name>.js`, Hugo bakes the stale path, and the approuter ships old bundles sitting next to the new ones. **Merged fixes look "not deployed" even though the deploy succeeded.** CI dodges this because `deploy.yml`/`unit-tests.yml` run `npm run postbuild:apps` as an **explicit step** (see deploy.yml:217-223 comment). Fix (2026-08-10): `build:all` now calls `npm run build:island-manifest` **explicitly** (not via the hook), and `scripts/deploy-mta.cjs` Step 2.5 fails the deploy if `hugo/public/index.html` bakes only unhashed island paths while a Vite manifest exists. Rule: any build **artifact** (not just a guard) needed for a correct ship must be an explicit step in `build:all`, never left to a `post*`/`pre*` lifecycle hook.
+- **`build:page-fallback` is an explicit `build:all` step (NOT a lifecycle hook)** — `scripts/build-page-fallback.cjs` copies in-scope page snapshots from `hugo/public` into `srv/page-fallback/<key>.<ext>` after `build:hugo` runs. Because `ignore-scripts=true` silences all `pre*`/`post*` hooks, it is wired as an explicit `npm run build:page-fallback` in the `build:all` chain, positioned right after `build:hugo`. If you add a new in-scope page to `IN_SCOPE_PAGES` in `srv/lib/page-key-map.js`, the snapshot is picked up automatically on the next full build. Snapshots are gitignored (`srv/page-fallback/*` except `.gitkeep`); the directory is committed empty and populated at build time.
+
+## Completions rollup (issue #1934)
+
+- **Group/Mission completions are rollup-derived** — the CAP rewrite never carried over the legacy IMS TUTORIAL→GROUP→MISSION rollup, so GROUP/MISSION `TaskRecords` stopped being created at the 2026-08-10 cutover. `srv/lib/completion-rollup.js` recomputes parent group(s)/mission(s) after any TUTORIAL/PUZZLE/CHECKPOINT/PETOBERFEST completion — called from `_updateTutorialProgress`, `resetTutorialProgress`, the CHECKPOINT edge of `createTaskRecord` (developer-service), `puzzle-service`, and `petoberfest-upload`. Slot model: alt-groups (`#172`) collapse to one slot where **any branch satisfies**; a nested GROUP slot needs all its tutorials. Records key on `(user_ID, taskLegacyId=<Groups|Missions>.legacyId, taskType)` and are upserted (SELECT-then-UPDATE-or-INSERT) with `stampSubmissionId` so they carry the NGDS dedup key. NGDS auto-send fires on the → COMPLETED edge (GROUP/MISSION are the only NGDS-eligible rollup types). The orchestrator never throws into the completion tx. Backfill (post-cutover only): `scripts/backfill-group-mission-completions.mjs` (bulk, `--dry-run`/`--since`/`--user`, no NGDS send) then `scripts/backfill-ngds-send.mjs` (rate-limited, resumable via `ImsConfig 'ngds.backfill.cursor'`, honors env=prod + kill-switch + epoch + canonical-sapId; receiver dedups on `submissionIdCompleted`). Pre-cutover completions are intentionally NOT re-minted (legacy IMS credited them; the NGDS epoch guard suppresses them). `completion-rollup.js` is NOT a `content-store.js` dependency → no `srv-qa` `cp` entry needed.
+
+## Content model — mutable ContentCurrent (Option B, #2017 / Workstream D)
+
+- **Content served from mutable `ContentCurrent`, not the old `ContentFiles` snapshot-per-version** — three env flags gate the migration, all default OFF, flip in order: `CONTENT_DELTA_WRITE_ENABLED` (publish dual-writes changed slugs → `ContentCurrent` + append-only `ContentHistory`, fail-safe) → **seed** via a full force rebuild (`-f mode=full -f force-publish=true` dual-writes all slugs; no separate migration) → `CONTENT_DELTA_READ_ENABLED` (serve/readers hit `ContentCurrent`, per-slug fallback to `ContentFiles`) → `CONTENT_DELTA_SKIP_CARRYFORWARD` (publish skips `carryForwardUnchanged` → **O(changed) publish**; rollback then **replays `ContentHistory`** into `ContentCurrent`, not clear+fallback). Measured DEV: publish commit ~62s→973ms (PROD carry-forward was ~95s @ 11k files). Serve source header `X-Content-Source: db-current` (ContentCurrent) vs `db` (legacy). Revert = flip `SKIP_CARRYFORWARD` off + `cf restart`. Flags in `srv/lib/feature-flags/registry.js`; readers via `resolveContentBlob` (`srv/lib/content-store.js`). LOB reads stay raw `db.run()`. Cutover cleanup (delete `carryForwardUnchanged` + `ContentFiles`) deferred to a release after PROD soak.
+
+## NGDS auto-send
+
+- **NGDS auto-send is PROD-only + DB-gated (double gate)** — automatic push of task completions to NGDS (badging/gamification) fires from `srv/lib/ngds-autosend.js#maybeAutoSendCompletion`, called at the two completion transition points in `srv/developer-service.js` (`_updateTutorialProgress` + `createTaskRecord`). Sends ONLY when BOTH gates pass: (1) CF `space_name==='prod'` (`resolveDeployEnvironment`, not spoofable headers) AND (2) `ImsConfig` key `ngds.autosend.enabled==='true'` (admin kill-switch via `AdminService.toggleNgdsAutoSend`; 60s flag cache, busted on toggle). Edge-only (fires on the transition → COMPLETED, never on repeat saves) and task-type-allowlisted to TUTORIAL/GROUP/MISSION (legacy parity — PUZZLE/PETOBERFEST/STEP never sent). Fails CLOSED (config read error → disabled) and never throws into the completion tx (a send fault queues in `NGDSFailedMessages` for the 2h retry job). Bulk recompute (raw HANA MERGE) + migration (raw SQL) bypass the service layer, so they cannot flood NGDS. Payload shape itself is the legacy `MessageModel` (#1473). Default OFF in every env; enable in PROD via the admin toggle. Status: `AdminService.getNgdsAutoSendConfig()` returns `{enabled, environment, effective}`.
+
+## Knowledge graph feature flags
+
+All default OFF and DEV-only unless noted. Toggles fail-open on every fault path.
+
+- **`KG_PAGERANK_ENABLED` (issue #916)** — when `'true'`, `rankNeighborhood` in `srv/knowledge-graph-service.js` multiplicatively blends per-tutorial PageRank (`weight *= 1 + α × normPR`) into all three tutorial-targeted arms (`prerequisitesOf`, `sharedConcepts`, `whatToLearnNext`) and sorts `teaches` by concept-side PageRank. Scores recomputed nightly at 03:53 UTC by `srv/jobs/kg-pagerank-job.js` — PageRank runs in **Node.js** (not HANA GraphScript — that engine ships no PageRank primitive) over `KG_PG_VERTICES_V` + `KG_PG_EDGES_V`, materialized into `ConceptRank`/`TutorialRank` sidecars. Fail-opens on every fault path (missing sidecars, HANA hiccup, empty maps → multiplier collapses to 1.0). Toggle: `cf set-env tutorials-srv KG_PAGERANK_ENABLED true && cf restart tutorials-srv`. Blend strength via `KG_PAGERANK_ALPHA` (default `1.0` → weights grow at most 2×).
+- **`KG_WCC_ISOLATION_THRESHOLD` (issue #918)** — nightly `srv/jobs/kg-wcc-job.js` runs at 04:07 UTC and materializes rows into `KgIsolation` for concept + tutorial vertices whose weakly-connected-component size ≤ threshold. Default `1`; `0` empties the table on the next run (effectively disables the "Isolated" red-badge column on the admin Concepts + Tutorials LRs). Compute is Node.js union-find over `KG_PG_VERTICES_V` + `KG_PG_EDGES_V` — same reason as #916 that HANA GraphScript ships no WCC primitive (SCC yes, WCC no). Fail-quiet at read time: the `after('READ')` decorators on `KnowledgeGraphService.Concepts` and `AdminService.Tutorials` catch any SELECT throw and leave `isolated` unset — Fiori renders `null` boolean as no badge. Toggle: `cf set-env tutorials-srv KG_WCC_ISOLATION_THRESHOLD 2 && cf restart tutorials-srv` (or `0` to disable).
+- **`KG_ONDEMAND_ENABLED` / `KnowledgeGraphSettings.onDemandExtractionEnabled` (issue #948)** — when `true`, `expandSearchConcepts` fire-and-forgets an enqueue on zero-seed queries; a new 2-minute cron `kg-ondemand-drain` cosine-ranks the corpus and extracts concepts from top-K tutorials via `extractConceptsFromTutorial`. Coalesces near-duplicate queries; per-user (default 3/hr) and global (default 20/hr) rate-limit caps. Env knobs: `KG_ONDEMAND_USER_MAX_PER_HOUR`, `KG_ONDEMAND_GLOBAL_MAX_PER_HOUR`, `KG_ONDEMAND_DRAIN_BATCH` (default 3), `KG_ONDEMAND_TUTORIALS_PER_REQ` (default 5), `KG_ONDEMAND_MAX_ATTEMPTS` (default 3). Admin surface: `/admin-ui/#kgOnDemand`. Drain uses try/finally to recover stuck RUNNING rows on UPDATE failure. On-demand extraction is now **link-only** (#1115) — it attaches existing concepts (0.7 floor) but never mints. Toggle: flip `onDemandExtractionEnabled=true` at `/admin-ui/#kg-settings` (or `cf set-env tutorials-srv KG_ONDEMAND_ENABLED true && cf restart tutorials-srv`).
+- **KG community detection (issue #917)** — Louvain community detection over `KG_PG_WORKSPACE` runs nightly at 03:57 UTC (`srv/jobs/kg-communities-job.js`) via HANA GraphScript `Communities_Louvain` in `db/src/procedures/KG_LOUVAIN_GRAPH.hdbprocedure`. Memberships materialize into the `KgCommunity` sidecar (`db/knowledge-graph-communities.cds`). Admin surface: `/admin-ui/#kgCommunities` renders a FE List Report (aggregated summary) + Object Page over `AdminService.KgCommunities` and `AdminService.KgCommunityMembers`. `promoteCommunityToMission(communityId, missionSlug, title)` action (SuperAdmin-gated) drafts a `Missions` row + `CompletionPaths` + `CompletionPathItems` sorted `Tutorials.title ASC`, with `Missions.sourceKgCommunityId` set so already-promoted communities can be filtered out. Nightly job fail-opens; empty sidecar renders as FE "No data", never a 500. **No env flag** — tile is always visible to XSUAA `Tutorial.Author` scope. **DEV-only in v1**; PROD rollout deferred. Metrics: `kg_communities_{duration_ms,count,max_size,failures}`.
+- **`KG_RETIRE_ORPHANS_ENABLED` / `KG_RETIRE_ORPHANS_AGE_DAYS` (issue #1115)** — nightly `srv/jobs/kg-retire-orphans-job.js` at 04:37 UTC flips `Concepts.status` ACTIVE→RETIRED for concepts with zero links across all 10 link tables and `firstSeenAt` older than `KG_RETIRE_ORPHANS_AGE_DAYS` (default 14). RETIRED falls out of every read path (all filter `status='ACTIVE'` positively). First-run retirement **ramps** rather than purging instantly. Reversible: `cf set-env tutorials-srv KG_RETIRE_ORPHANS_ENABLED false` (off) or bulk `UPDATE Concepts SET status='ACTIVE' WHERE status='RETIRED'` (data revert). A re-proposed retired slug is reactivated in-tx by `kg-merge-on-write.js` (`retiredBySlug` + `action:'reactivated'`).
+- **KG community peers + community labeling (issue #1126)** — `communityPeersEnabled` on `ChatSettings` (default `false`) gates the `findCommunityPeers` Joule tool (`srv/lib/kg/joule-tool-community-peers.js`). When enabled, the tool accepts a `tutorial_slug`, looks up the anchor's `communityFingerprint` in `KgCommunity`, and returns sibling tutorials from the same Louvain cluster plus the LLM-generated cluster label from `KgCommunityLabel`. Nightly `kg-community-labels` job (`srv/jobs/kg-community-label-job.js`) runs at 04:12 UTC (after Louvain at 03:57) and LLM-names each community with ≥ 2 tutorials. Identity key is `communityFingerprint` (String(64)); skip-key is `memberSlugsHash` (SHA-256 of sorted slugs) — stable member sets incur zero LLM calls. Daily budget is `communityLabelLlmBudgetPerDay` on `ChatSettings` (default 50). Fail-open per community. Toggle: `communityPeersEnabled` is a `ChatSettings` column (NOT an env var), enabled by an Admin via `PATCH /admin/ChatSettings(<ID>)` on the AdminService singleton (the `/admin-ui/#joule` Joule Settings page edits the same entity but does not yet surface this flag). **DEV-only until PROD Louvain data verifies.** Metrics: `kg_community_label_{duration_ms,labeled,skipped,failures}`.
+- **`KG_COMMUNITY_WEIGHT` (issue #1171)** — when `> 0`, `SearchService.before('READ')` appends a SECOND additive rank term `+ KG_COMMUNITY_WEIGHT * (case slug when '<peer>' then 1.0 else 0 end)` alongside the existing concept-overlap `KG_WEIGHT` (#945). Peers are tutorials sharing a Louvain `communityFingerprint` (#917/#1126) with the top-`COMMUNITY_TOP_K` (5) concept-overlap hits. Default `0` (OFF) → `buildCommunityRankFragment` in `srv/lib/search-kg-signal.js` short-circuits before any DB fetch and the rank SQL is byte-identical to the #945 formula. **Only fires when `ChatSettings.searchKgRerankEnabled=true`**. Fail-open (any DB throw → term collapses to `''`). Membership fetched packet-safe (≤5 fingerprints `.in()`, members capped 200, filtered in Node). Regression harness + churn report at `test/harness/community-rank-churn*`; do NOT enable in any env before the ON-vs-OFF churn is hand-reviewed. Toggle: `cf set-env tutorials-srv KG_COMMUNITY_WEIGHT 1.5 && cf restart tutorials-srv` (with `searchKgRerankEnabled=true`).
+- **`KG_COMMUNITY_COVERAGE_NUDGE_THRESHOLD` (issue #1172)** — the `after('READ','KgCommunities')` decorator in `srv/admin-service.js` computes, per community at read time, mission-coverage % + dominant published mission + orphan-tutorial count (helper: `srv/lib/kg-community-coverage.js`) and populates virtual fields on `AdminService.KgCommunities`. Coverage is **published-missions-only** and the % denominator is **tutorial members only** (concept/tag-only communities render N/A, not 0%). `coverageHigh` (`>= threshold`, default **70**) is the single server-computed flag driving both the LR criticality badge and the FE promote-time `MessageBox.warning` ("~X% already in `<mission>` — extend instead?"). **Fail-quiet** in its own try/catch: any throw → warn-log, fields unset, no badge, never a 500. No new job/table/migration — computed live. Packet-safe: the covered-slug `.in()` is chunked at 500. SuperAdmin gate on `promoteCommunityToMission` unchanged; the nudge is advisory. Override: `cf set-env tutorials-srv KG_COMMUNITY_COVERAGE_NUDGE_THRESHOLD 80 && cf restart tutorials-srv`. DEV-only until the #1126 PROD Louvain rollout lands.
+- **Cluster-level Q&A in Joule (issue #1173)** — `describeCommunity` Joule tool (`srv/lib/kg/joule-tool-describe-community.js`) answers "what's the AI cluster?" / "everything around RAP" by resolving a free-text topic to a labeled Louvain community. **LLM-side matching:** `communityCatalogLayer` in `srv/lib/chat-context.js` injects the labeled-cluster catalog (from `KgCommunityLabel`, cached ~5min, cap 40) into the learner system prompt **only when `communityPeersEnabled` is true**; the model passes the chosen label as `matched_label`, and `matchLabel` (`srv/lib/kg/community-label-match.js`, pure) does case-insensitive exact match + token-overlap fallback + ambiguity detection. Reuses the existing `communityPeersEnabled` flag (NO new flag/schema), the `community-peers-cards` SSE frame + `renderCommunityPeersCards` render path, and the extracted `resolveCommunityMembers` helper (`srv/lib/kg/community-members.js`). Fail-open throughout (never 500). **Gotcha:** `buildSystemPromptLines` in `chat-orchestrator.js` is DEAD at runtime — `buildSystemPrompt` (chat-context.js) never calls it; the live guidance ships via `communityCatalogLayer`. DEV-only until PROD Louvain data verifies.
+
+## HCQL protocol adapter (issue #995)
+
+- **HCQL protocol adapter** — CAP 10 beta feature. `@hcql` annotation on 9 read-heavy services (AdminService, AuthorService, AnalyticsService, ExportsService, ConsolidationService, KnowledgeGraphService, HomepageService, SearchService, DeveloperService) in `srv/hcql-enablement.cds` exposes each service at its existing OData URL to also accept CQN `SELECT` bodies (HCQL and OData share URLs; dispatch is by request-body shape). Auth inherited from existing `@readonly`/`@requires`. Writes intentionally unsupported (beta not stable cross-runtime). **Runtime hazard:** CAP 10.0.3 exits the process on malformed CQN — do not expose to untrusted clients until CAP hardens the adapter. Kill switch: delete `srv/hcql-enablement.cds`, `cds build --production`, redeploy. Full reference: [hcql-support.md](hcql-support.md).
+
+## Freshness detector
+
+- **Freshness detector grounding needs the corpus-embedding backfill** — the `checkFreshness`/`freshness-scan` engine cosine-searches `ApiDocs`/`Samples` embeddings. Those columns are populated by `srv/jobs/freshness-corpus-embedding-job.js` (nightly `17 3` + on-demand `runJob`). Until it runs in an env, grounding returns nothing and every API-obsolescence claim degrades to `confidence: Low` (fail-open, by design). LLM calls use the SAP AI SDK directly (`@sap-ai-sdk/orchestration`, forced tool-call), NOT `@cap-js/ai`; unit tests inject `globalThis.__FRESHNESS_TEST_IMPL__`. Bulk scan gated by `FRESHNESS_SCAN_ENABLED` (default OFF). **Tutorial markdown is sourced from `ContentFiles.sourceContent` via `getTutorialSource(slug)` in `srv/lib/content-store.js` — NOT from `Steps.description`** (Steps are never populated with step markdown; reading Steps would yield nothing). Findings carry a **global `codeBlockIndex`** across the whole-tutorial markdown — per-step attribution is deferred because the persisted source is not split per step.
diff --git a/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase1-empty-facets.md b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase1-empty-facets.md
new file mode 100644
index 000000000..b2ee34f24
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase1-empty-facets.md
@@ -0,0 +1,1215 @@
+# Tutorials Admin OP — Phase 1 (Empty Facets) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Populate the three empty Tutorials Object Page facets — Categories, Contributors, Validation Questions — by closing the fetch/publish pipeline gaps that leave their backing entities unpopulated.
+
+**Architecture:** Reuse the existing "fetch-sidecar → publish aux step → server REPLACE-per-slug inside `cds.tx()`" pattern (proven by `validate-answer-spec-publish.js`). Contributors and full validation rules get new `<slug>.<feature>.json` cache sidecars written in the same `fetch-tutorials.ts` per-tutorial pass, POSTed by new client collectors in `publish-content.ts`, and upserted by new `srv/lib/*-publish.js` handlers. Categories are fixed by a fire-and-forget `classifyAndPersist('tutorial', id)` call after publish upserts a tutorial (publish bypasses the CAP `after('CREATE')` hook), plus a one-time backfill.
+
+**Tech Stack:** SAP CAP (Node.js, CDS), HANA (prod) / SQLite (unit), Fiori Elements annotations (`app/admin-annotations.cds`), Vitest (unit + hybrid projects).
+
+**Spec:** `docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md`
+
+## Global Constraints
+
+- **Slugs are lowercase-canonical** — lowercase in both sidecar filename and JSON body; server resolves tutorial by lowercased slug.
+- **REPLACE-per-slug** — publishing slug A must never touch slug B's rows. DELETE-by-`tutorial_ID` then INSERT inside `cds.tx()`.
+- **srv-qa cp-list** — every new `srv/lib/*.js` MUST be appended to the `cp` command in `.deploy/mta.yaml` module `tutorials-srv-qa` (~line 175), or QA boot fails with `MODULE_NOT_FOUND`.
+- **QA namespace guard** — new publish routes apply the `entity_not_in_model` fail-fast guard and skip the aux step on `channel === 'qa'` if the QA CDS model lacks the entity.
+- **Never throw into the publish/completion tx** — fire-and-forget classification must `.catch(warn)`.
+- **Schema changes** — `cds build --production`; register new persisted entities in `db/persistence.cds` (`@cds.persistence.journal`); never hand-author `.hdbmigrationtable`; run `npx cds deploy --to sqlite::memory:` before committing db changes.
+- **BLOB reads stay raw `db.run()`** — never mix LOB + metadata in one CDS QL query (not expected in Phase 1).
+- **Aux publish steps are non-fatal** — a sidecar publish failure warns, never fails the deploy.
+- **Tests:** unit via `npm test` (in-memory SQLite); hybrid via `npm run test:hybrid` (real HANA, `--project hybrid`). Bare `vitest <file>` skips hybrid setup.
+- **PR targets DEV, never main.**
+
+---
+
+## File Structure
+
+**WS1 — Categories self-heal + backfill:**
+- Modify: `srv/lib/content-publish-session.js` — add fire-and-forget `classifyAndPersist` loop over touched `tutorialIds` after the metadata/authorship block.
+- Test: `test/unit/publish-category-selfheal.test.js`, `test/hybrid/publish-categories.test.js`.
+- Ops: run `scripts/backfill-categories.cjs` (existing).
+
+**WS2 — Contributors:**
+- Modify: `db/schema.cds` — add `login`/`avatarUrl`/`profileUrl` to `TutorialContributors`.
+- Modify: `db/persistence.cds` — ensure `TutorialContributors` journaled.
+- Modify: `scripts/fetch-tutorials.ts` — write `<slug>.contributors.json` sidecar.
+- Create: `scripts/publish/publish-contributors.ts` (client collector), wired into `scripts/publish-content.ts`.
+- Create: `srv/lib/contributors-publish.js` (server REPLACE handler).
+- Modify: `srv/server.js` — mount the publish route.
+- Modify: `app/admin-annotations.cds` — add `login` (GitHub link) + `avatarUrl` to `TutorialContributors` `@UI.LineItem`.
+- Modify: `.deploy/mta.yaml` — add `contributors-publish.js` to srv-qa cp-list.
+- Test: `test/unit/contributors-publish.test.js`, `test/hybrid/publish-contributors.test.js`.
+
+**WS3 — All validation rules:**
+- Modify: `db/schema.cds` — add `TutorialValidationRules` entity.
+- Modify: `db/persistence.cds` — journal `TutorialValidationRules`.
+- Modify: `srv/admin-service.cds` — projection + `validationRules` association on `Tutorials`.
+- Modify: `scripts/parsers/rules.ts` — add `collectAllRules()` alongside `collectAiGradedSpecs()`.
+- Modify: `scripts/fetch-tutorials.ts` — write `<slug>.validation-rules.json` sidecar.
+- Create: `scripts/publish/publish-validation-rules.ts` + wire into `publish-content.ts`.
+- Create: `srv/lib/validation-rules-publish.js`.
+- Modify: `srv/server.js` — mount route.
+- Modify: `app/admin-annotations.cds` — relabel AI facet "AI-Graded Validation"; add "All Validation Rules" facet + LineItem.
+- Modify: `.deploy/mta.yaml` — add `validation-rules-publish.js` to srv-qa cp-list.
+- Test: `test/unit/collect-all-rules.test.js`, `test/unit/validation-rules-publish.test.js`, `test/hybrid/publish-validation-rules.test.js`.
+
+---
+
+## WS1 — Categories: self-heal at publish + backfill
+
+### Task 1: Fire-and-forget classification after publish upsert
+
+**Files:**
+- Modify: `srv/lib/content-publish-session.js` (~line 198-210, after `upsertTutorialMetadata`/`linkTutorialAuthorship`; `tutorialIds` already collected/returned per research)
+- Test: `test/unit/publish-category-selfheal.test.js`
+
+**Interfaces:**
+- Consumes: `classifyAndPersist(kind, id, _opts?)` — named export from `srv/lib/category-classifier.js:127`.
+- Produces: nothing new; side effect is `TutorialCategories` rows for published tutorials.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/publish-category-selfheal.test.js
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// Mock the classifier so the test asserts invocation without real embeddings/LLM.
+const classifySpy = vi.fn().mockResolvedValue(undefined)
+vi.mock('../../srv/lib/category-classifier.js', () => ({
+  classifyAndPersist: classifySpy,
+}))
+
+import { classifyTouchedTutorials } from '../../srv/lib/content-publish-session.js'
+
+describe('publish category self-heal', () => {
+  beforeEach(() => classifySpy.mockClear())
+
+  it('classifies every touched tutorial id, fire-and-forget', async () => {
+    await classifyTouchedTutorials(['id-a', 'id-b'])
+    expect(classifySpy).toHaveBeenCalledTimes(2)
+    expect(classifySpy).toHaveBeenCalledWith('tutorial', 'id-a')
+    expect(classifySpy).toHaveBeenCalledWith('tutorial', 'id-b')
+  })
+
+  it('never rejects even if a classification throws', async () => {
+    classifySpy.mockRejectedValueOnce(new Error('boom'))
+    await expect(classifyTouchedTutorials(['id-a'])).resolves.toBeUndefined()
+  })
+})
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/unit/publish-category-selfheal.test.js --project unit`
+Expected: FAIL — `classifyTouchedTutorials` is not exported.
+
+- [ ] **Step 3: Implement the helper + call site**
+
+In `srv/lib/content-publish-session.js`, add near the top (after existing imports):
+
+```js
+const { classifyAndPersist } = require('./category-classifier.js')
+
+// Exported for unit testing; classifies touched tutorials without ever throwing
+// into the publish tx (publish bypasses the CAP after('CREATE') classifier hook).
+async function classifyTouchedTutorials(tutorialIds) {
+  await Promise.all(
+    (tutorialIds || []).map((id) =>
+      Promise.resolve()
+        .then(() => classifyAndPersist('tutorial', id))
+        .catch((e) => console.warn('[publish] category classify skipped', id, e?.message)),
+    ),
+  )
+}
+module.exports.classifyTouchedTutorials = classifyTouchedTutorials
+```
+
+> Match the file's existing module system. Research shows `category-classifier.js` uses ES named exports; if `content-publish-session.js` is CommonJS, use dynamic `import()` inside the helper instead of top-level `require`. Verify the first two lines of `content-publish-session.js` before choosing.
+
+Then at the post-metadata call site (~line 198-210, where `tutorialIds` is in scope):
+
+```js
+// Fire-and-forget: keep categories populated for publish-created tutorials.
+classifyTouchedTutorials(tutorialIds)
+```
+
+(No `await` — must not block or fail the publish.)
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/unit/publish-category-selfheal.test.js --project unit`
+Expected: PASS (both cases).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/content-publish-session.js test/unit/publish-category-selfheal.test.js
+git commit -m "feat(publish): self-heal categories via classifyAndPersist after upsert (#WS1)"
+```
+
+### Task 2: Hybrid guard — published tutorial gets categories
+
+**Files:**
+- Test: `test/hybrid/publish-categories.test.js`
+
+**Interfaces:**
+- Consumes: real `AdminService` + publish session against HANA (via `cds bind --exec`).
+
+- [ ] **Step 1: Write the hybrid test**
+
+```js
+// test/hybrid/publish-categories.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('publish populates categories (hybrid)', () => {
+  let db
+  beforeAll(async () => { db = await cds.connect.to('db') })
+
+  it('a freshly published tutorial has >= 0 category rows and no orphan write errors', async () => {
+    // Precondition: category seed embeddings must exist in this env.
+    const { Categories } = cds.entities('com.sap.developers.ims')
+    const seeds = await db.run(SELECT.from(Categories))
+    expect(seeds.length).toBeGreaterThan(0) // else run embedAllSeeds first
+
+    // Assert the classifier is reachable and idempotent for a known slug.
+    // (Use a slug known to exist in the bound DB.)
+    const { Tutorials, TutorialCategories } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    const rows = await db.run(SELECT.from(TutorialCategories).where({ tutorial_ID: t.ID }))
+    expect(Array.isArray(rows)).toBe(true)
+  })
+})
+```
+
+- [ ] **Step 2: Run the hybrid test**
+
+Run: `npm run test:hybrid -- test/hybrid/publish-categories.test.js`
+Expected: PASS if seed embeddings exist. If `seeds.length === 0`, run the `embedAllSeeds` admin action first, then re-run.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add test/hybrid/publish-categories.test.js
+git commit -m "test(publish): hybrid guard for category population (#WS1)"
+```
+
+### Task 3: One-time backfill (ops step — documented, not code)
+
+**Files:** none (uses existing `scripts/backfill-categories.cjs`).
+
+- [ ] **Step 1: Confirm seed embeddings exist** — via admin action `embedAllSeeds` on the target env, or query `Categories` seed rows.
+- [ ] **Step 2: Dry-run then run backfill**
+
+Run (against bound env): `node scripts/backfill-categories.cjs --dry-run` then without the flag.
+Expected: rows inserted into `TutorialCategories` for previously-empty tutorials.
+
+- [ ] **Step 3: Spot-check in admin UI** — open the reference tutorial's Categories facet; confirm rows render.
+
+---
+
+## WS2 — Contributors: map git list + GitHub links
+
+### Task 4: Schema — add GitHub columns to TutorialContributors
+
+**Files:**
+- Modify: `db/schema.cds:451-457` (`TutorialContributors`)
+- Modify: `db/persistence.cds` (ensure journaled)
+- Test: `test/unit/schema-contributors.test.js`
+
+**Interfaces:**
+- Produces: `TutorialContributors` now has `login : String(255)`, `avatarUrl : String(1024)`, `profileUrl : String(1024)`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/schema-contributors.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('TutorialContributors schema', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('has GitHub link columns', () => {
+    const e = m.definitions['com.sap.developers.ims.TutorialContributors']
+    expect(e.elements.login).toBeTruthy()
+    expect(e.elements.avatarUrl).toBeTruthy()
+    expect(e.elements.profileUrl).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `npx vitest run test/unit/schema-contributors.test.js --project unit`
+Expected: FAIL — elements undefined.
+
+- [ ] **Step 3: Add the columns**
+
+In `db/schema.cds`, extend the `TutorialContributors` entity body:
+
+```cds
+entity TutorialContributors : cuid, LegacyKeyed {
+  tutorial   : Association to Tutorials;
+  name       : String(255);
+  email      : String(255);
+  role       : String(50);
+  login      : String(255);   // GitHub handle
+  avatarUrl  : String(1024);  // https://github.com/<login>.png
+  profileUrl : String(1024);  // https://github.com/<login>
+  user       : Association to Users;
+}
+```
+
+Confirm `db/persistence.cds` journals `TutorialContributors` (add `@cds.persistence.journal` registration entry if a new column set requires a migration table — follow the existing entries' shape).
+
+- [ ] **Step 4: Verify schema + deploy dry-run**
+
+Run: `npx vitest run test/unit/schema-contributors.test.js --project unit`
+Then: `npx cds deploy --to sqlite::memory:`
+Expected: test PASS; deploy succeeds with no errors.
+
+- [ ] **Step 5: Build migration + commit**
+
+```bash
+npx cds build --production
+git add db/schema.cds db/persistence.cds db/src/gen test/unit/schema-contributors.test.js
+git commit -m "feat(db): add GitHub link columns to TutorialContributors (#WS2)"
+```
+
+### Task 5: Fetch sidecar — write `<slug>.contributors.json`
+
+**Files:**
+- Modify: `scripts/fetch-tutorials.ts` (~line 1043, beside the validate-answer sidecar write; `contributors` array in scope from ~`:936-948`)
+- Test: `test/unit/contributors-sidecar.test.js`
+
+**Interfaces:**
+- Produces: cache file `<lowercased-slug>.contributors.json` = `{ slug, contributors: Array<{login,name,email,avatarUrl}> }` (max 10).
+
+- [ ] **Step 1: Write the failing test** (extract a pure helper to keep it testable)
+
+```js
+// test/unit/contributors-sidecar.test.js
+import { describe, it, expect } from 'vitest'
+import { buildContributorsSidecar } from '../../scripts/parsers/contributors-sidecar'
+
+describe('buildContributorsSidecar', () => {
+  it('lowercases slug and caps at 10', () => {
+    const contribs = Array.from({ length: 12 }, (_, i) => ({
+      login: `u${i}`, name: `N${i}`, email: `${i}@x.com`, avatarUrl: `a${i}`,
+    }))
+    const out = buildContributorsSidecar('My-Slug', contribs)
+    expect(out.slug).toBe('my-slug')
+    expect(out.contributors).toHaveLength(10)
+    expect(out.contributors[0]).toEqual({ login: 'u0', name: 'N0', email: '0@x.com', avatarUrl: 'a0' })
+  })
+  it('returns null when no contributors', () => {
+    expect(buildContributorsSidecar('s', [])).toBeNull()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `npx vitest run test/unit/contributors-sidecar.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the helper + wire the write**
+
+Create `scripts/parsers/contributors-sidecar.ts`:
+
+```ts
+export interface SidecarContributor { login: string; name: string; email: string; avatarUrl: string }
+export interface ContributorsSidecar { slug: string; contributors: SidecarContributor[] }
+
+export function buildContributorsSidecar(
+  slug: string,
+  contributors: Array<Partial<SidecarContributor>>,
+): ContributorsSidecar | null {
+  if (!contributors || contributors.length === 0) return null
+  return {
+    slug: slug.toLowerCase(),
+    contributors: contributors.slice(0, 10).map((c) => ({
+      login: c.login ?? '', name: c.name ?? '', email: c.email ?? '', avatarUrl: c.avatarUrl ?? '',
+    })),
+  }
+}
+```
+
+In `scripts/fetch-tutorials.ts`, beside the validate-answer write (~`:1043`):
+
+```ts
+import { buildContributorsSidecar } from './parsers/contributors-sidecar'
+// ...
+const contribSidecar = buildContributorsSidecar(t.slug, contributors)
+if (contribSidecar) {
+  writeFileSync(
+    join(CACHE_DIR, `${t.slug.toLowerCase()}.contributors.json`),
+    JSON.stringify(contribSidecar, null, 2),
+  )
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `npx vitest run test/unit/contributors-sidecar.test.js --project unit`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/parsers/contributors-sidecar.ts scripts/fetch-tutorials.ts test/unit/contributors-sidecar.test.js
+git commit -m "feat(fetch): write contributors sidecar from git contributor list (#WS2)"
+```
+
+### Task 6: Server handler — REPLACE contributors per slug
+
+**Files:**
+- Create: `srv/lib/contributors-publish.js`
+- Modify: `srv/server.js` (mount route, mirror validate-answer mount)
+- Modify: `.deploy/mta.yaml` (~line 175, srv-qa cp-list)
+- Test: `test/unit/contributors-publish.test.js`
+
+**Interfaces:**
+- Consumes: POST body `{ slug, contributors: [{login,name,email,avatarUrl}] }`.
+- Produces: `publishContributors(req, res)` Express handler; REPLACE-by-`tutorial_ID` in `TutorialContributors`.
+
+- [ ] **Step 1: Write the failing test** (mirror `validate-answer-spec-publish` test shape, in-memory SQLite)
+
+```js
+// test/unit/contributors-publish.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceContributorsForSlug } from '../../srv/lib/contributors-publish.js'
+
+describe('replaceContributorsForSlug', () => {
+  let db
+  beforeAll(async () => {
+    await cds.test('serve', '--in-memory').in(process.cwd())
+    db = await cds.connect.to('db')
+  })
+
+  it('replaces rows for the slug and derives profileUrl', async () => {
+    const { Tutorials, TutorialContributors } = cds.entities('com.sap.developers.ims')
+    const ID = cds.utils.uuid()
+    await db.run(INSERT.into(Tutorials).entries({ ID, slug: 'demo', title: 'Demo' }))
+
+    await replaceContributorsForSlug(db, 'DEMO', [
+      { login: 'octocat', name: 'Octo Cat', email: 'o@x.com', avatarUrl: 'https://github.com/octocat.png' },
+    ])
+    let rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].login).toBe('octocat')
+    expect(rows[0].profileUrl).toBe('https://github.com/octocat')
+
+    // Second publish REPLACES, does not append.
+    await replaceContributorsForSlug(db, 'demo', [
+      { login: 'hubot', name: 'Hubot', email: 'h@x.com', avatarUrl: 'https://github.com/hubot.png' },
+    ])
+    rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].login).toBe('hubot')
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `npx vitest run test/unit/contributors-publish.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement the handler**
+
+Create `srv/lib/contributors-publish.js` (mirror `validate-answer-spec-publish.js` structure — namespace guard, per-slug REPLACE in `cds.tx()`):
+
+```js
+const cds = require('@sap/cds')
+const NS = 'com.sap.developers.ims'
+const MAX_FIELD_BYTES = 2000
+
+function githubProfileUrl(login) {
+  return login ? `https://github.com/${login}` : null
+}
+
+// Core, unit-testable: REPLACE all contributor rows for one slug.
+async function replaceContributorsForSlug(db, slug, contributors) {
+  const { Tutorials, TutorialContributors } = cds.entities(NS)
+  const lcSlug = String(slug || '').toLowerCase()
+  const tut = await db.run(SELECT.one.from(Tutorials).columns('ID').where({ slug: lcSlug }))
+  if (!tut) return { ok: false, reason: 'tutorial_not_found', slug: lcSlug }
+
+  const entries = (contributors || [])
+    .filter((c) => c && (c.login || c.name || c.email))
+    .slice(0, 10)
+    .map((c) => ({
+      ID: cds.utils.uuid(),
+      tutorial_ID: tut.ID,
+      login: (c.login || '').slice(0, 255),
+      name: (c.name || '').slice(0, 255),
+      email: (c.email || '').slice(0, 255),
+      avatarUrl: (c.avatarUrl || '').slice(0, 1024),
+      profileUrl: githubProfileUrl(c.login),
+    }))
+
+  await cds.tx(async (tx) => {
+    await tx.run(DELETE.from(TutorialContributors).where({ tutorial_ID: tut.ID }))
+    if (entries.length) await tx.run(INSERT.into(TutorialContributors).entries(entries))
+  })
+  return { ok: true, slug: lcSlug, count: entries.length }
+}
+
+// Express handler mirroring validate-answer-spec-publish route.
+async function publishContributors(req, res) {
+  try {
+    const { slug, contributors } = req.body || {}
+    if (!slug || !Array.isArray(contributors)) {
+      return res.status(400).json({ error: 'bad_request', detail: 'expected { slug, contributors[] }' })
+    }
+    let entities
+    try { entities = cds.entities(NS) } catch { entities = null }
+    if (!entities || !entities.TutorialContributors) {
+      return res.status(409).json({ error: 'entity_not_in_model' })
+    }
+    const db = await cds.connect.to('db')
+    const result = await replaceContributorsForSlug(db, slug, contributors)
+    if (!result.ok) return res.status(404).json(result)
+    return res.json(result)
+  } catch (e) {
+    return res.status(500).json({ error: 'internal', detail: e?.message })
+  }
+}
+
+module.exports = { replaceContributorsForSlug, publishContributors, githubProfileUrl }
+```
+
+Mount in `srv/server.js` beside the validate-answer route (guard with the same `CONTENT_API_KEY` middleware the other publish routes use):
+
+```js
+const { publishContributors } = require('./lib/contributors-publish.js')
+app.post('/content/publish-contributors', requireContentApiKey, express.json({ limit: '1mb' }), publishContributors)
+```
+
+> Verify the exact auth-middleware name and JSON body parser used by the existing `/content/publish` + validate-answer routes and match it.
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `npx vitest run test/unit/contributors-publish.test.js --project unit`
+Expected: PASS (both replace + derive assertions).
+
+- [ ] **Step 5: Add to srv-qa cp-list**
+
+In `.deploy/mta.yaml`, module `tutorials-srv-qa` `cp` command (~line 175), append `../../srv/lib/contributors-publish.js` to the `srv/lib/` copy segment.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add srv/lib/contributors-publish.js srv/server.js .deploy/mta.yaml test/unit/contributors-publish.test.js
+git commit -m "feat(publish): server REPLACE handler for TutorialContributors (#WS2)"
+```
+
+### Task 7: Client publish step + wire into publish-content
+
+**Files:**
+- Create: `scripts/publish/publish-contributors.ts`
+- Modify: `scripts/publish-content.ts` (~line 1327-1352, beside `publishValidateAnswerSpecs`; non-fatal aux step)
+- Test: `test/unit/publish-contributors-client.test.js`
+
+**Interfaces:**
+- Consumes: cache dir globbed for `*.contributors.json`; POSTs each to `/content/publish-contributors`.
+- Produces: `publishContributors({ cacheDir, baseUrl, apiKey })`.
+
+- [ ] **Step 1: Write the failing test** (mock `fetch`)
+
+```js
+// test/unit/publish-contributors-client.test.js
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { publishContributors } from '../../scripts/publish/publish-contributors'
+
+describe('publishContributors client', () => {
+  let dir
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'contrib-'))
+    writeFileSync(join(dir, 'demo.contributors.json'),
+      JSON.stringify({ slug: 'demo', contributors: [{ login: 'octocat', name: 'O', email: 'o@x', avatarUrl: 'a' }] }))
+    global.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ ok: true, count: 1 }) })
+  })
+  afterEach(() => { vi.restoreAllMocks() })
+
+  it('POSTs each sidecar to the endpoint', async () => {
+    const res = await publishContributors({ cacheDir: dir, baseUrl: 'http://x', apiKey: 'k' })
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    const [url, opts] = global.fetch.mock.calls[0]
+    expect(url).toBe('http://x/content/publish-contributors')
+    expect(JSON.parse(opts.body).slug).toBe('demo')
+    expect(res.published).toBe(1)
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `npx vitest run test/unit/publish-contributors-client.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Implement + wire**
+
+Create `scripts/publish/publish-contributors.ts`:
+
+```ts
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export async function publishContributors(opts: { cacheDir: string; baseUrl: string; apiKey: string }) {
+  const { cacheDir, baseUrl, apiKey } = opts
+  const files = readdirSync(cacheDir).filter((f) => f.endsWith('.contributors.json'))
+  let published = 0
+  for (const f of files) {
+    const body = readFileSync(join(cacheDir, f), 'utf8')
+    const res = await fetch(`${baseUrl}/content/publish-contributors`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-api-key': apiKey },
+      body,
+    })
+    if (res.ok) published += 1
+    else console.warn(`[publish-contributors] ${f} -> ${res.status}`)
+  }
+  return { published, total: files.length }
+}
+```
+
+> Match the exact auth header name the existing publish client uses (research: validate-answer client — confirm `x-api-key` vs `authorization`).
+
+In `scripts/publish-content.ts`, beside `publishValidateAnswerSpecs` (~`:1327`), add a non-fatal aux step, skipping QA channel:
+
+```ts
+if (channel !== 'qa') {
+  try {
+    const r = await publishContributors({ cacheDir: CACHE_DIR, baseUrl, apiKey })
+    console.log(`[publish] contributors: ${r.published}/${r.total}`)
+  } catch (e) {
+    console.warn('[publish] contributors step failed (non-fatal)', (e as Error).message)
+  }
+}
+```
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `npx vitest run test/unit/publish-contributors-client.test.js --project unit`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/publish/publish-contributors.ts scripts/publish-content.ts test/unit/publish-contributors-client.test.js
+git commit -m "feat(publish): non-fatal client step to publish contributors sidecars (#WS2)"
+```
+
+### Task 8: UI — GitHub-linked Contributors LineItem
+
+**Files:**
+- Modify: `app/admin-annotations.cds:715-725` (`TutorialContributors` `@UI.LineItem`)
+- Test: `test/unit/annotations-contributors.test.js`
+
+**Interfaces:**
+- Consumes: `TutorialContributors.login`/`avatarUrl`/`profileUrl` (Task 4).
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/annotations-contributors.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('Contributors LineItem', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('LineItem includes login column', () => {
+    const e = m.definitions['AdminService.TutorialContributors']
+    const li = e['@UI.LineItem']
+    const values = li.map((x) => x.Value?.['='] || x.Value)
+    expect(values).toContain('login')
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails**
+
+Run: `npx vitest run test/unit/annotations-contributors.test.js --project unit`
+Expected: FAIL — `login` not in LineItem.
+
+- [ ] **Step 3: Add columns + GitHub link**
+
+In `app/admin-annotations.cds`, extend the `TutorialContributors` `@UI.LineItem` (add `login` and render it as an external link to `profileUrl`):
+
+```cds
+annotate AdminService.TutorialContributors with @(
+  UI.LineItem: [
+    { Value: name,  Label: 'Name' },
+    { Value: login, Label: 'GitHub', @HTML5.LinkTarget: '_blank' },
+    { Value: email, Label: 'Email' },
+    { Value: role,  Label: 'Role' }
+  ]
+);
+annotate AdminService.TutorialContributors with {
+  login @Common.Text: profileUrl @Common.TextArrangement: #TextOnly;
+};
+```
+
+> Preferred: make `login` a link via a `DataFieldWithUrl` pointing at `profileUrl` so the cell navigates to `github.com/<login>`:
+> ```cds
+> { $Type: 'UI.DataFieldWithUrl', Value: login, Url: profileUrl, Label: 'GitHub' }
+> ```
+> Use whichever renders as a clickable GitHub link in the current FE version; verify against the running admin UI.
+
+- [ ] **Step 4: Run to verify it passes**
+
+Run: `npx vitest run test/unit/annotations-contributors.test.js --project unit`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add app/admin-annotations.cds test/unit/annotations-contributors.test.js
+git commit -m "feat(admin-ui): GitHub-linked login column on Contributors table (#WS2)"
+```
+
+### Task 9: Hybrid guard — publish links contributors to tutorial
+
+**Files:**
+- Test: `test/hybrid/publish-contributors.test.js`
+
+- [ ] **Step 1: Write the hybrid test**
+
+```js
+// test/hybrid/publish-contributors.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceContributorsForSlug } from '../../srv/lib/contributors-publish.js'
+
+describe('contributors publish (hybrid)', () => {
+  let db
+  beforeAll(async () => { db = await cds.connect.to('db') })
+  it('links contributor rows to an existing tutorial by slug', async () => {
+    const { Tutorials, TutorialContributors } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    await replaceContributorsForSlug(db, t.slug, [
+      { login: 'octocat', name: 'Octo', email: 'o@x.com', avatarUrl: 'https://github.com/octocat.png' },
+    ])
+    const rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: t.ID, login: 'octocat' }))
+    expect(rows.length).toBe(1)
+    expect(rows[0].profileUrl).toBe('https://github.com/octocat')
+    // cleanup
+    await db.run(DELETE.from(TutorialContributors).where({ tutorial_ID: t.ID, login: 'octocat' }))
+  })
+})
+```
+
+- [ ] **Step 2: Run** `npm run test:hybrid -- test/hybrid/publish-contributors.test.js` — Expected: PASS.
+- [ ] **Step 3: Commit**
+
+```bash
+git add test/hybrid/publish-contributors.test.js
+git commit -m "test(publish): hybrid guard for contributor linking (#WS2)"
+```
+
+---
+
+## WS3 — All validation rules
+
+### Task 10: Schema — `TutorialValidationRules` entity
+
+**Files:**
+- Modify: `db/schema.cds` (add entity near `ValidateAnswerSpecs` ~`:865`)
+- Modify: `db/persistence.cds` (journal it)
+- Test: `test/unit/schema-validation-rules.test.js`
+
+**Interfaces:**
+- Produces: `com.sap.developers.ims.TutorialValidationRules` with key `(tutorial, stepNumber, questionId)`, fields `questionText`, `ruleType`, `questionType`, `choiceMode`, `options` (LargeString JSON), `correctAnswer`, `aiGrading : Boolean`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/schema-validation-rules.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('TutorialValidationRules schema', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('exists with expected elements', () => {
+    const e = m.definitions['com.sap.developers.ims.TutorialValidationRules']
+    expect(e).toBeTruthy()
+    for (const k of ['stepNumber','questionId','questionText','ruleType','questionType','choiceMode','options','correctAnswer','aiGrading'])
+      expect(e.elements[k]).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — `npx vitest run test/unit/schema-validation-rules.test.js --project unit` → FAIL.
+
+- [ ] **Step 3: Add the entity**
+
+In `db/schema.cds`:
+
+```cds
+entity TutorialValidationRules {
+  key tutorial     : Association to Tutorials;
+  key stepNumber   : Integer;
+  key questionId   : String(100);
+      questionText : String(2000);
+      ruleType     : String(50);   // single-choice | multiple-choice | regex | exact-match | ...
+      questionType : String(20);   // MCQ | TEXT
+      choiceMode   : String(20);   // single | multiple | null
+      options      : LargeString;  // JSON array of option strings (MCQ) or null
+      correctAnswer: LargeString;  // reference answer (client-graded) or null when aiGrading
+      aiGrading    : Boolean default false;
+}
+```
+
+Register in `db/persistence.cds` mirroring the existing entries' `@cds.persistence.journal` shape.
+
+- [ ] **Step 4: Verify + deploy dry-run** — `npx vitest run test/unit/schema-validation-rules.test.js --project unit` then `npx cds deploy --to sqlite::memory:` → PASS + clean deploy.
+
+- [ ] **Step 5: Build migration + commit**
+
+```bash
+npx cds build --production
+git add db/schema.cds db/persistence.cds db/src/gen test/unit/schema-validation-rules.test.js
+git commit -m "feat(db): add TutorialValidationRules entity for all rules.vr rules (#WS3)"
+```
+
+### Task 11: Parser — `collectAllRules()`
+
+**Files:**
+- Modify: `scripts/parsers/rules.ts` (add beside `collectAiGradedSpecs` ~`:312`)
+- Test: `test/unit/collect-all-rules.test.js`
+
+**Interfaces:**
+- Consumes: `validationMap`, `ruleTypeByStepAndId`, `correctAnswerByStepAndId` (from `parseRulesVrEnriched`).
+- Produces: `collectAllRules(map, ruleTypeMap, answerMap) => Array<{ stepNumber, questionId, questionText, ruleType, questionType, choiceMode, options, correctAnswer, aiGrading }>`.
+
+- [ ] **Step 1: Write the failing test**
+
+```ts
+// test/unit/collect-all-rules.test.ts
+import { describe, it, expect } from 'vitest'
+import { collectAllRules } from '../../scripts/parsers/rules'
+
+describe('collectAllRules', () => {
+  it('includes non-AI MCQ rules with options + correctAnswer', () => {
+    const map = new Map([[1, [
+      { id: 'validate-1', question: 'Pick one', type: 'QUESTION_TYPE_MCQ', options: ['A','B'], choiceMode: 'single', correctAnswer: 'A' },
+      { id: 'validate-1b', question: 'AI graded', type: 'QUESTION_TYPE_TEXT', aiGrading: true },
+    ]]])
+    const ruleTypeMap = new Map([['1::validate-1', 'single-choice'], ['1::validate-1b', 'regex']])
+    const answerMap = new Map([['1::validate-1', 'A']])
+    const rows = collectAllRules(map, ruleTypeMap, answerMap)
+    expect(rows).toHaveLength(2)
+    const mcq = rows.find((r) => r.questionId === 'validate-1')
+    expect(mcq.aiGrading).toBe(false)
+    expect(mcq.questionType).toBe('MCQ')
+    expect(JSON.parse(mcq.options)).toEqual(['A','B'])
+    expect(mcq.correctAnswer).toBe('A')
+    const ai = rows.find((r) => r.questionId === 'validate-1b')
+    expect(ai.aiGrading).toBe(true)
+    expect(ai.correctAnswer).toBeNull()
+  })
+})
+```
+
+> Confirm the exact key format of `ruleTypeByStepAndId`/`correctAnswerByStepAndId` in `rules.ts` (research indicated a `step::id` style). Adjust the test's key strings to match the real format before implementing.
+
+- [ ] **Step 2: Run to verify it fails** — `npx vitest run test/unit/collect-all-rules.test.ts --project unit` → FAIL.
+
+- [ ] **Step 3: Implement `collectAllRules`**
+
+In `scripts/parsers/rules.ts` (adapt key access to the confirmed map format):
+
+```ts
+export interface AllRuleRow {
+  stepNumber: number; questionId: string; questionText: string;
+  ruleType: string; questionType: 'MCQ' | 'TEXT'; choiceMode: string | null;
+  options: string | null; correctAnswer: string | null; aiGrading: boolean;
+}
+
+export function collectAllRules(
+  map: Map<number, ValidationQuestion[]>,
+  ruleTypeByStepAndId: Map<string, string>,
+  correctAnswerByStepAndId: Map<string, string>,
+): AllRuleRow[] {
+  const rows: AllRuleRow[] = []
+  for (const [stepNumber, questions] of map.entries()) {
+    for (const q of questions) {
+      const key = `${stepNumber}::${q.id}`
+      const isMcq = q.type === 'QUESTION_TYPE_MCQ'
+      const ai = Boolean((q as any).aiGrading)
+      rows.push({
+        stepNumber,
+        questionId: q.id,
+        questionText: q.question,
+        ruleType: ruleTypeByStepAndId.get(key) ?? '',
+        questionType: isMcq ? 'MCQ' : 'TEXT',
+        choiceMode: (q as any).choiceMode ?? null,
+        options: isMcq && (q as any).options ? JSON.stringify((q as any).options) : null,
+        correctAnswer: ai ? null : (correctAnswerByStepAndId.get(key) ?? (q as any).correctAnswer ?? null),
+        aiGrading: ai,
+      })
+    }
+  }
+  return rows
+}
+```
+
+- [ ] **Step 4: Run to verify it passes** — `npx vitest run test/unit/collect-all-rules.test.ts --project unit` → PASS.
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/parsers/rules.ts test/unit/collect-all-rules.test.ts
+git commit -m "feat(parser): collectAllRules for full rules.vr rule set (#WS3)"
+```
+
+### Task 12: Fetch sidecar — `<slug>.validation-rules.json`
+
+**Files:**
+- Modify: `scripts/fetch-tutorials.ts` (~`:975` where `validationMap` etc. are destructured; write beside other sidecars ~`:1043`)
+- Test: covered by Task 11 helper + Task 13 server test; add a small write-path assertion.
+
+- [ ] **Step 1: Wire the sidecar write**
+
+```ts
+import { collectAllRules } from './parsers/rules'
+// ...
+const allRules = collectAllRules(validationMap, ruleTypeByStepAndId, correctAnswerByStepAndId)
+if (allRules.length > 0) {
+  writeFileSync(
+    join(CACHE_DIR, `${t.slug.toLowerCase()}.validation-rules.json`),
+    JSON.stringify({ slug: t.slug.toLowerCase(), rules: allRules }, null, 2),
+  )
+}
+```
+
+- [ ] **Step 2: Sanity build** — run `npm run fetch-tutorials` for a small subset if a `--slug`/limit flag exists, or type-check: `npx tsc --noEmit -p tsconfig.json` (confirm project has this). Expected: no type errors.
+- [ ] **Step 3: Commit**
+
+```bash
+git add scripts/fetch-tutorials.ts
+git commit -m "feat(fetch): write validation-rules sidecar (all rule types) (#WS3)"
+```
+
+### Task 13: Server handler — REPLACE validation rules per slug
+
+**Files:**
+- Create: `srv/lib/validation-rules-publish.js`
+- Modify: `srv/server.js` (mount route)
+- Modify: `.deploy/mta.yaml` (srv-qa cp-list ~line 175)
+- Test: `test/unit/validation-rules-publish.test.js`
+
+**Interfaces:**
+- Consumes: `{ slug, rules: AllRuleRow[] }`.
+- Produces: `replaceValidationRulesForSlug(db, slug, rules)` + `publishValidationRules(req, res)`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/validation-rules-publish.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceValidationRulesForSlug } from '../../srv/lib/validation-rules-publish.js'
+
+describe('replaceValidationRulesForSlug', () => {
+  let db
+  beforeAll(async () => { await cds.test('serve', '--in-memory').in(process.cwd()); db = await cds.connect.to('db') })
+  it('replaces all-rule rows for a slug', async () => {
+    const { Tutorials, TutorialValidationRules } = cds.entities('com.sap.developers.ims')
+    const ID = cds.utils.uuid()
+    await db.run(INSERT.into(Tutorials).entries({ ID, slug: 'vr-demo', title: 'VR' }))
+    await replaceValidationRulesForSlug(db, 'VR-DEMO', [
+      { stepNumber: 1, questionId: 'validate-1', questionText: 'Q', ruleType: 'single-choice', questionType: 'MCQ', choiceMode: 'single', options: '["A","B"]', correctAnswer: 'A', aiGrading: false },
+    ])
+    let rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].aiGrading).toBe(false)
+    await replaceValidationRulesForSlug(db, 'vr-demo', [])
+    rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(0)
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — `npx vitest run test/unit/validation-rules-publish.test.js --project unit` → FAIL.
+
+- [ ] **Step 3: Implement the handler** (mirror `contributors-publish.js`)
+
+```js
+const cds = require('@sap/cds')
+const NS = 'com.sap.developers.ims'
+
+async function replaceValidationRulesForSlug(db, slug, rules) {
+  const { Tutorials, TutorialValidationRules } = cds.entities(NS)
+  const lcSlug = String(slug || '').toLowerCase()
+  const tut = await db.run(SELECT.one.from(Tutorials).columns('ID').where({ slug: lcSlug }))
+  if (!tut) return { ok: false, reason: 'tutorial_not_found', slug: lcSlug }
+  const entries = (rules || []).map((r) => ({
+    tutorial_ID: tut.ID,
+    stepNumber: r.stepNumber,
+    questionId: String(r.questionId).slice(0, 100),
+    questionText: (r.questionText || '').slice(0, 2000),
+    ruleType: (r.ruleType || '').slice(0, 50),
+    questionType: (r.questionType || '').slice(0, 20),
+    choiceMode: r.choiceMode || null,
+    options: r.options || null,
+    correctAnswer: r.correctAnswer ?? null,
+    aiGrading: Boolean(r.aiGrading),
+  }))
+  await cds.tx(async (tx) => {
+    await tx.run(DELETE.from(TutorialValidationRules).where({ tutorial_ID: tut.ID }))
+    if (entries.length) await tx.run(INSERT.into(TutorialValidationRules).entries(entries))
+  })
+  return { ok: true, slug: lcSlug, count: entries.length }
+}
+
+async function publishValidationRules(req, res) {
+  try {
+    const { slug, rules } = req.body || {}
+    if (!slug || !Array.isArray(rules)) return res.status(400).json({ error: 'bad_request' })
+    let entities; try { entities = cds.entities(NS) } catch { entities = null }
+    if (!entities || !entities.TutorialValidationRules) return res.status(409).json({ error: 'entity_not_in_model' })
+    const db = await cds.connect.to('db')
+    const result = await replaceValidationRulesForSlug(db, slug, rules)
+    return res.status(result.ok ? 200 : 404).json(result)
+  } catch (e) { return res.status(500).json({ error: 'internal', detail: e?.message }) }
+}
+
+module.exports = { replaceValidationRulesForSlug, publishValidationRules }
+```
+
+Mount in `srv/server.js`:
+
+```js
+const { publishValidationRules } = require('./lib/validation-rules-publish.js')
+app.post('/content/publish-validation-rules', requireContentApiKey, express.json({ limit: '4mb' }), publishValidationRules)
+```
+
+- [ ] **Step 4: Run to verify it passes** — `npx vitest run test/unit/validation-rules-publish.test.js --project unit` → PASS.
+- [ ] **Step 5: Add to srv-qa cp-list** — append `../../srv/lib/validation-rules-publish.js` to the `.deploy/mta.yaml` srv-qa `cp` command (~line 175).
+- [ ] **Step 6: Commit**
+
+```bash
+git add srv/lib/validation-rules-publish.js srv/server.js .deploy/mta.yaml test/unit/validation-rules-publish.test.js
+git commit -m "feat(publish): server REPLACE handler for TutorialValidationRules (#WS3)"
+```
+
+### Task 14: Client publish step for validation rules
+
+**Files:**
+- Create: `scripts/publish/publish-validation-rules.ts`
+- Modify: `scripts/publish-content.ts` (beside contributors aux step)
+- Test: `test/unit/publish-validation-rules-client.test.js`
+
+**Interfaces:**
+- Produces: `publishValidationRules({ cacheDir, baseUrl, apiKey })` — globs `*.validation-rules.json`, POSTs to `/content/publish-validation-rules`.
+
+- [ ] **Step 1: Write the failing test** (mirror Task 7 client test, glob `*.validation-rules.json`, endpoint `/content/publish-validation-rules`).
+
+```js
+// test/unit/publish-validation-rules-client.test.js
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'; import { tmpdir } from 'node:os'
+import { publishValidationRules } from '../../scripts/publish/publish-validation-rules'
+
+describe('publishValidationRules client', () => {
+  let dir
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'vr-'))
+    writeFileSync(join(dir, 'demo.validation-rules.json'),
+      JSON.stringify({ slug: 'demo', rules: [{ stepNumber: 1, questionId: 'validate-1' }] }))
+    global.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ ok: true }) })
+  })
+  afterEach(() => vi.restoreAllMocks())
+  it('POSTs each sidecar', async () => {
+    const res = await publishValidationRules({ cacheDir: dir, baseUrl: 'http://x', apiKey: 'k' })
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    expect(global.fetch.mock.calls[0][0]).toBe('http://x/content/publish-validation-rules')
+    expect(res.published).toBe(1)
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL (module not found).
+
+- [ ] **Step 3: Implement + wire** (copy `publish-contributors.ts`, swap glob suffix + endpoint):
+
+```ts
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+export async function publishValidationRules(opts: { cacheDir: string; baseUrl: string; apiKey: string }) {
+  const { cacheDir, baseUrl, apiKey } = opts
+  const files = readdirSync(cacheDir).filter((f) => f.endsWith('.validation-rules.json'))
+  let published = 0
+  for (const f of files) {
+    const res = await fetch(`${baseUrl}/content/publish-validation-rules`, {
+      method: 'POST', headers: { 'content-type': 'application/json', 'x-api-key': apiKey },
+      body: readFileSync(join(cacheDir, f), 'utf8'),
+    })
+    if (res.ok) published += 1; else console.warn(`[publish-validation-rules] ${f} -> ${res.status}`)
+  }
+  return { published, total: files.length }
+}
+```
+
+In `scripts/publish-content.ts`, add a non-fatal aux step (skip `channel === 'qa'`), mirroring Task 7.
+
+- [ ] **Step 4: Run to verify it passes** — → PASS.
+- [ ] **Step 5: Commit**
+
+```bash
+git add scripts/publish/publish-validation-rules.ts scripts/publish-content.ts test/unit/publish-validation-rules-client.test.js
+git commit -m "feat(publish): non-fatal client step to publish validation-rules sidecars (#WS3)"
+```
+
+### Task 15: Service projection + association + UI facets
+
+**Files:**
+- Modify: `srv/admin-service.cds` (projection + association on `Tutorials`)
+- Modify: `app/admin-annotations.cds` (relabel AI facet; add "All Validation Rules" facet + LineItem)
+- Test: `test/unit/annotations-validation-rules.test.js`
+
+**Interfaces:**
+- Consumes: `TutorialValidationRules` (Task 10).
+- Produces: `AdminService.TutorialValidationRules` (read-only) + `Tutorials.validationRules` association.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/annotations-validation-rules.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('validation rules exposure + facet', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('AdminService exposes TutorialValidationRules read-only', () => {
+    expect(m.definitions['AdminService.TutorialValidationRules']).toBeTruthy()
+  })
+  it('Tutorials has validationRules association', () => {
+    expect(m.definitions['AdminService.Tutorials'].elements.validationRules).toBeTruthy()
+  })
+  it('OP facets include an All Validation Rules facet', () => {
+    const facets = m.definitions['AdminService.Tutorials']['@UI.Facets']
+    const ids = facets.map((f) => f.ID)
+    expect(ids).toContain('AllValidationRulesFacet')
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement projection + association + facets**
+
+In `srv/admin-service.cds`:
+
+```cds
+@readonly entity TutorialValidationRules as projection on ims.TutorialValidationRules;
+```
+
+Add to the `Tutorials` projection body (beside `validationSpecs` ~`:66`):
+
+```cds
+validationRules : Association to many TutorialValidationRules on validationRules.tutorial = $self;
+```
+
+In `app/admin-annotations.cds`:
+1. Relabel the existing AI facet (`ValidationSpecsFacet`, ~`:957`) `Label: 'AI-Graded Validation'`.
+2. Add a LineItem + facet:
+
+```cds
+annotate AdminService.TutorialValidationRules with @(
+  UI.LineItem: [
+    { Value: stepNumber,   Label: 'Step' },
+    { Value: questionText,  Label: 'Question' },
+    { Value: questionType,  Label: 'Type' },
+    { Value: ruleType,      Label: 'Rule' },
+    { Value: aiGrading,     Label: 'AI-Graded' },
+    { Value: correctAnswer, Label: 'Correct Answer' }
+  ]
+);
+```
+
+Add to the winning `@UI.Facets` block (~`:948-974`):
+
+```cds
+{ $Type: 'UI.ReferenceFacet', Label: 'All Validation Rules', ID: 'AllValidationRulesFacet', Target: 'validationRules/@UI.LineItem' },
+```
+
+- [ ] **Step 4: Run to verify it passes** — `npx vitest run test/unit/annotations-validation-rules.test.js --project unit` → PASS. Then `npx cds deploy --to sqlite::memory:` → clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/admin-service.cds app/admin-annotations.cds test/unit/annotations-validation-rules.test.js
+git commit -m "feat(admin-ui): All Validation Rules facet + relabel AI facet (#WS3)"
+```
+
+### Task 16: Hybrid guard — publish populates all rules
+
+**Files:**
+- Test: `test/hybrid/publish-validation-rules.test.js`
+
+- [ ] **Step 1: Write the hybrid test** — publish a slug via `replaceValidationRulesForSlug` against HANA, assert both AI and non-AI rows land in `TutorialValidationRules`, and that AI rows still exist in `ValidateAnswerSpecs` (unchanged). Clean up after.
+
+```js
+// test/hybrid/publish-validation-rules.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceValidationRulesForSlug } from '../../srv/lib/validation-rules-publish.js'
+describe('validation rules publish (hybrid)', () => {
+  let db; beforeAll(async () => { db = await cds.connect.to('db') })
+  it('lands mixed AI + client rules for an existing slug', async () => {
+    const { Tutorials, TutorialValidationRules } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID','slug'))
+    await replaceValidationRulesForSlug(db, t.slug, [
+      { stepNumber: 99, questionId: 'vr-test-a', questionText: 'client', ruleType: 'single-choice', questionType: 'MCQ', choiceMode: 'single', options: '["A"]', correctAnswer: 'A', aiGrading: false },
+      { stepNumber: 99, questionId: 'vr-test-b', questionText: 'ai', ruleType: 'regex', questionType: 'TEXT', choiceMode: null, options: null, correctAnswer: null, aiGrading: true },
+    ])
+    const rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: t.ID, stepNumber: 99 }))
+    expect(rows.length).toBe(2)
+    await db.run(DELETE.from(TutorialValidationRules).where({ tutorial_ID: t.ID, stepNumber: 99 }))
+  })
+})
+```
+
+- [ ] **Step 2: Run** `npm run test:hybrid -- test/hybrid/publish-validation-rules.test.js` → PASS.
+- [ ] **Step 3: Commit**
+
+```bash
+git add test/hybrid/publish-validation-rules.test.js
+git commit -m "test(publish): hybrid guard for all-rules population (#WS3)"
+```
+
+---
+
+## Final verification (whole phase)
+
+- [ ] Run full unit suite: `npm test` — Expected: all green.
+- [ ] Run affected hybrid tests: `npm run test:hybrid -- test/hybrid/publish-categories.test.js test/hybrid/publish-contributors.test.js test/hybrid/publish-validation-rules.test.js` (requires `cf login` + `cds bind`).
+- [ ] `npx cds deploy --to sqlite::memory:` clean (schema sanity).
+- [ ] Confirm both new `srv/lib/*-publish.js` files are in the `.deploy/mta.yaml` srv-qa `cp` list.
+- [ ] Open a PR targeting **DEV** summarizing WS1-WS3 + the one-time category backfill ops step.
+
+## Post-deploy validation (DEV)
+
+- [ ] After DEV deploy + a content publish, open the reference tutorial's OP:
+  - Categories facet shows rows (post-backfill + self-heal).
+  - Contributors table shows the git contributor list, each `login` linking to `github.com/<login>`.
+  - "All Validation Rules" facet shows every rule; "AI-Graded Validation" still shows the AI subset.
+
+## Self-review notes (author)
+
+- **Spec coverage:** WS1 (Tasks 1-3), WS2 (Tasks 4-9), WS3 (Tasks 10-16) map to spec §WS1-WS3. WS4 (KG) and WS5 (media+freshness) are deferred to separate plans per the spec's phasing.
+- **Assumptions flagged for the implementer to verify against live code before writing:** (a) module system of `content-publish-session.js` (CommonJS vs ESM) for Task 1; (b) exact auth-middleware + header name used by existing publish routes (Tasks 6/7/13/14); (c) exact key format of `ruleTypeByStepAndId`/`correctAnswerByStepAndId` (Task 11); (d) the FE link idiom that renders a clickable GitHub link (Task 8). These are grounded by research but must be confirmed at the touched lines.
diff --git a/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase2-media-freshness.md b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase2-media-freshness.md
new file mode 100644
index 000000000..452cfd33d
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase2-media-freshness.md
@@ -0,0 +1,371 @@
+# Tutorials Admin OP — Phase 2 (Media + Freshness Header) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Surface per-tutorial object-store items (images + assets) with rich detail and a download/preview link, and add a Freshness report facet (last-run/model/cost/status) to the Tutorials Object Page.
+
+**Architecture:** `TutorialImages`/`TutorialAssets` are persisted but exposed on no service. Add `@readonly` projections on `AdminService` reachable from `Tutorials` via slug/channel associations; the `content : Composition of many Attachments` child auto-exposes with `@cap-js/attachments` media annotations (`@Core.MediaType`/`@Core.ContentDisposition`/`@UI.MediaResource`) so Fiori renders a native download link. Persist `byteSize` at image/asset ingest (already in memory as `buffer.length`). `FreshnessReport` is already exposed — add an association from `Tutorials` and a sorted LineItem facet.
+
+**Tech Stack:** SAP CAP (Node.js, CDS), `@cap-js/attachments` 4.0.0, Fiori Elements annotations, Vitest.
+
+**Spec:** `docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md` (§WS5, decisions D1/D2)
+
+## Global Constraints
+
+- **D1 (prod S3 binding):** the Media facet works regardless of backing store; the missing `objectstore` resource in `mta.yaml` is a **separate ops task**, out of scope here. Do not add the S3 binding in this plan.
+- **D2:** add `byteSize : Integer64`; **defer** width/height.
+- **Read-only exposure** — projections are `@readonly`; use `@cds.redirection.target: false` (pattern at `srv/admin-service.cds:114,120`) to avoid stealing association redirects.
+- **BLOB reads stay raw `db.run()`** — never mix LOB + metadata in one CDS QL query.
+- **Schema changes** — `cds build --production`; register in `db/persistence.cds`; `npx cds deploy --to sqlite::memory:` before committing.
+- **Associations on `slug`** — `TutorialImages`/`TutorialAssets` join `Tutorials` on `slug` (unmanaged `on`), filtered `channel = 'prod'`.
+- **Tests:** `npm test` (unit), `npm run test:hybrid` (real HANA). PR targets DEV.
+
+## File Structure
+
+- Modify: `db/tutorial-images.cds`, `db/tutorial-assets.cds` — add `byteSize`.
+- Modify: `db/persistence.cds` — journal (if needed for new column).
+- Modify: `srv/lib/image-ingest-handler.js` (~`:77`) + the asset ingest handler — persist `byteSize`.
+- Modify: `srv/admin-service.cds` — `@readonly` projections + `images`/`assets`/`freshnessReports` associations on `Tutorials`.
+- Modify: `app/admin-annotations.cds` — Media facet (2 LineItems w/ download link + external sourceUrl) + Freshness Reports facet.
+- Test: `test/unit/schema-media.test.js`, `test/unit/annotations-media.test.js`, `test/unit/annotations-freshness-facet.test.js`, `test/hybrid/media-exposure.test.js`.
+
+---
+
+### Task 1: Schema — add `byteSize` to images + assets
+
+**Files:**
+- Modify: `db/tutorial-images.cds:7-16`, `db/tutorial-assets.cds:6-16`
+- Modify: `db/persistence.cds`
+- Test: `test/unit/schema-media.test.js`
+
+**Interfaces:**
+- Produces: `TutorialImages.byteSize : Integer64`, `TutorialAssets.byteSize : Integer64`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/schema-media.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('media byteSize', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('images + assets have byteSize', () => {
+    expect(m.definitions['com.sap.developers.ims.TutorialImages'].elements.byteSize).toBeTruthy()
+    expect(m.definitions['com.sap.developers.ims.TutorialAssets'].elements.byteSize).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — `npx vitest run test/unit/schema-media.test.js --project unit` → FAIL.
+
+- [ ] **Step 3: Add the column** (both files):
+
+```cds
+byteSize : Integer64;  // original byte length captured at ingest
+```
+
+Register in `db/persistence.cds` if the column needs a migration-table entry (follow existing shape).
+
+- [ ] **Step 4: Verify + deploy dry-run** — test PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Build + commit**
+
+```bash
+npx cds build --production
+git add db/tutorial-images.cds db/tutorial-assets.cds db/persistence.cds db/src/gen test/unit/schema-media.test.js
+git commit -m "feat(db): add byteSize to TutorialImages/TutorialAssets (#WS5)"
+```
+
+### Task 2: Persist `byteSize` at ingest
+
+**Files:**
+- Modify: `srv/lib/image-ingest-handler.js` (~`:60-77`, where `contentHash`/`mimeType` are computed and `imageStore.put` is called)
+- Modify: the asset ingest handler (per research: `srv/lib/attachment-source-handler.js:118` region / the asset ingest analog — confirm exact put call)
+- Modify: `srv/lib/image-store.cjs` + `srv/lib/attachment-store.cjs` — accept/persist `byteSize` on the parent row
+- Test: `test/unit/ingest-bytesize.test.js`
+
+**Interfaces:**
+- Consumes: `buffer` at ingest.
+- Produces: parent `TutorialImages`/`TutorialAssets` row carries `byteSize = buffer.length`.
+
+- [ ] **Step 1: Write the failing test** (unit-level against the store put, in-memory SQLite)
+
+```js
+// test/unit/ingest-bytesize.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+const store = require('../../srv/lib/image-store.cjs')
+
+describe('image store persists byteSize', () => {
+  beforeAll(async () => { await cds.test('serve', '--in-memory').in(process.cwd()) })
+  it('stores buffer length as byteSize', async () => {
+    const db = await cds.connect.to('db')
+    const buf = Buffer.from('hello world')
+    await store.put('https://raw.example/img.png', { buffer: buf, mimeType: 'image/png', contentHash: 'abc', slug: 'demo', channel: 'prod', byteSize: buf.length })
+    const { TutorialImages } = cds.entities('com.sap.developers.ims')
+    const row = await db.run(SELECT.one.from(TutorialImages).where({ sourceUrl: 'https://raw.example/img.png' }))
+    expect(row.byteSize).toBe(11)
+  })
+})
+```
+
+> Confirm `image-store.cjs` `put()` signature + how it writes the parent row before finalizing the test; adapt arg shape to the real API.
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL (byteSize null/undefined).
+
+- [ ] **Step 3: Implement**
+
+In `srv/lib/image-ingest-handler.js`, pass `byteSize: buffer.length` into the `imageStore.put(...)` options (~`:77`). In `srv/lib/image-store.cjs`, include `byteSize` in the parent-row INSERT/UPSERT. Mirror both for assets (`attachment-store.cjs` + the asset ingest handler).
+
+- [ ] **Step 4: Run to verify it passes** — → PASS.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/image-ingest-handler.js srv/lib/image-store.cjs srv/lib/attachment-store.cjs test/unit/ingest-bytesize.test.js
+git commit -m "feat(media): persist byteSize at image/asset ingest (#WS5)"
+```
+
+> If the asset ingest handler lives in a distinct file, add it to this commit and to the srv-qa cp-list if not already present.
+
+### Task 3: Expose read-only Media projections + associations
+
+**Files:**
+- Modify: `srv/admin-service.cds`
+- Test: `test/unit/media-exposure.test.js`
+
+**Interfaces:**
+- Produces: `AdminService.TutorialImages`, `AdminService.TutorialAssets` (`@readonly`); `Tutorials.images`, `Tutorials.assets` associations (join on `slug`, `channel='prod'`).
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/media-exposure.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('media exposure', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('exposes images + assets read-only', () => {
+    expect(m.definitions['AdminService.TutorialImages']).toBeTruthy()
+    expect(m.definitions['AdminService.TutorialAssets']).toBeTruthy()
+  })
+  it('Tutorials has images + assets associations', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.images).toBeTruthy()
+    expect(t.assets).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement**
+
+In `srv/admin-service.cds`:
+
+```cds
+@readonly @cds.redirection.target: false entity TutorialImages as projection on ims.TutorialImages;
+@readonly @cds.redirection.target: false entity TutorialAssets as projection on ims.TutorialAssets;
+```
+
+Add to the `Tutorials` projection body:
+
+```cds
+images : Association to many TutorialImages on images.slug = $self.slug and images.channel = 'prod';
+assets : Association to many TutorialAssets on assets.slug = $self.slug and assets.channel = 'prod';
+```
+
+> The `content` Attachments composition auto-exposes when reachable from an exposed entity (@cap-js/attachments relies on this).
+
+- [ ] **Step 4: Run to verify it passes** — test PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/admin-service.cds test/unit/media-exposure.test.js
+git commit -m "feat(admin): read-only Media projections + Tutorials associations (#WS5)"
+```
+
+### Task 4: UI — Media facet with download link + detail
+
+**Files:**
+- Modify: `app/admin-annotations.cds`
+- Test: `test/unit/annotations-media.test.js`
+
+**Interfaces:**
+- Consumes: `AdminService.TutorialImages/TutorialAssets` + their `content` media child.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/annotations-media.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('Media facet', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('OP facets include Media', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('MediaImagesFacet')
+    expect(ids).toContain('MediaAssetsFacet')
+  })
+  it('image LineItem shows sourceUrl + byteSize + mimeType', () => {
+    const li = m.definitions['AdminService.TutorialImages']['@UI.LineItem']
+    const vals = li.map((x) => x.Value?.['='] || x.Value)
+    for (const c of ['sourceUrl','byteSize','mimeType','contentHash']) expect(vals).toContain(c)
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement**
+
+In `app/admin-annotations.cds`, add LineItems (render `sourceUrl` as external link via `DataFieldWithUrl`; the media download comes from the auto-exposed `content` child's ready-made annotations — a nested facet on `content` gives the download link):
+
+```cds
+annotate AdminService.TutorialImages with @(
+  UI.LineItem: [
+    { $Type: 'UI.DataFieldWithUrl', Value: sourceUrl, Url: sourceUrl, Label: 'Source (GitHub)' },
+    { Value: mimeType,   Label: 'Type' },
+    { Value: byteSize,   Label: 'Bytes' },
+    { Value: contentHash, Label: 'Hash' },
+    { Value: channel,    Label: 'Channel' }
+  ]
+);
+annotate AdminService.TutorialAssets with @(
+  UI.LineItem: [
+    { Value: filename,   Label: 'File' },
+    { $Type: 'UI.DataFieldWithUrl', Value: sourceUrl, Url: sourceUrl, Label: 'Source (GitHub)' },
+    { Value: mimeType,   Label: 'Type' },
+    { Value: byteSize,   Label: 'Bytes' },
+    { Value: contentHash, Label: 'Hash' }
+  ]
+);
+```
+
+Add facets to the winning `@UI.Facets` block:
+
+```cds
+{ $Type: 'UI.ReferenceFacet', Label: 'Images', ID: 'MediaImagesFacet', Target: 'images/@UI.LineItem' },
+{ $Type: 'UI.ReferenceFacet', Label: 'Assets', ID: 'MediaAssetsFacet', Target: 'assets/@UI.LineItem' },
+```
+
+> The @cap-js/attachments `content` child ships its own `@UI.LineItem` with a media download link. To surface a clickable download/preview, optionally add a nested facet targeting `images/content/@UI.LineItem` once verified against the running FE version.
+
+- [ ] **Step 4: Run to verify it passes** — → PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add app/admin-annotations.cds test/unit/annotations-media.test.js
+git commit -m "feat(admin-ui): Media facets (images/assets) with source link + byte size (#WS5)"
+```
+
+### Task 5: Freshness Reports facet (header)
+
+**Files:**
+- Modify: `srv/admin-service.cds` — add `freshnessReports` association on `Tutorials`
+- Modify: `app/admin-annotations.cds` — LineItem + facet, sorted by `runAt` desc via `@UI.PresentationVariant`
+- Test: `test/unit/annotations-freshness-facet.test.js`
+
+**Interfaces:**
+- Consumes: `AdminService.FreshnessReport` (already exposed `srv/admin-service.cds:129`).
+- Produces: `Tutorials.freshnessReports` association + `FreshnessReportsFacet`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/annotations-freshness-facet.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('Freshness reports facet', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('Tutorials has freshnessReports association', () => {
+    expect(m.definitions['AdminService.Tutorials'].elements.freshnessReports).toBeTruthy()
+  })
+  it('OP facets include FreshnessReportsFacet', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('FreshnessReportsFacet')
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement**
+
+In `srv/admin-service.cds` `Tutorials` projection:
+
+```cds
+freshnessReports : Association to many FreshnessReport on freshnessReports.tutorial = $self;
+```
+
+In `app/admin-annotations.cds`:
+
+```cds
+annotate AdminService.FreshnessReport with @(
+  UI.LineItem: [
+    { Value: runAt,         Label: 'Run At' },
+    { Value: status,        Label: 'Status' },
+    { Value: model,         Label: 'Model' },
+    { Value: cost,          Label: 'Cost' },
+    { Value: openHighCount, Label: 'Open High' },
+    { Value: error,         Label: 'Error' }
+  ],
+  UI.PresentationVariant: { SortOrder: [{ Property: runAt, Descending: true }], Visualizations: ['@UI.LineItem'] }
+);
+```
+
+Add to `@UI.Facets` (place above the existing Freshness findings facet):
+
+```cds
+{ $Type: 'UI.ReferenceFacet', Label: 'Freshness Reports', ID: 'FreshnessReportsFacet', Target: 'freshnessReports/@UI.PresentationVariant' },
+```
+
+- [ ] **Step 4: Run to verify it passes** — → PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/admin-service.cds app/admin-annotations.cds test/unit/annotations-freshness-facet.test.js
+git commit -m "feat(admin-ui): Freshness Reports facet (runAt/model/cost/status) (#WS5)"
+```
+
+### Task 6: Hybrid guard — media exposure resolves
+
+**Files:**
+- Test: `test/hybrid/media-exposure.test.js`
+
+- [ ] **Step 1: Write the hybrid test**
+
+```js
+// test/hybrid/media-exposure.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('media exposure (hybrid)', () => {
+  let admin; beforeAll(async () => { admin = await cds.connect.to('AdminService') })
+  it('reads images for a tutorial without LOB errors', async () => {
+    const t = await admin.run(SELECT.one.from('AdminService.Tutorials').columns('ID','slug'))
+    expect(t).toBeTruthy()
+    // metadata-only read (no BLOB mix)
+    const imgs = await admin.run(SELECT.from('AdminService.TutorialImages').columns('ID','sourceUrl','mimeType','byteSize').where({ slug: t.slug }))
+    expect(Array.isArray(imgs)).toBe(true)
+  })
+})
+```
+
+- [ ] **Step 2: Run** `npm run test:hybrid -- test/hybrid/media-exposure.test.js` → PASS.
+- [ ] **Step 3: Commit**
+
+```bash
+git add test/hybrid/media-exposure.test.js
+git commit -m "test(media): hybrid guard for media exposure (#WS5)"
+```
+
+---
+
+## Final verification
+
+- [ ] `npm test` all green; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] Backfill media if needed: `npm run backfill-images` (+ assets) against the env so rows exist.
+- [ ] DEV post-deploy: reference tutorial OP shows Images + Assets tables (source link, type, bytes, hash) and a Freshness Reports table sorted newest-first.
+
+## Self-review notes
+
+- **Spec coverage:** WS5 §Media (Tasks 1-4, 6) + §Freshness header (Task 5). D1 respected (no S3 binding change). D2 respected (byteSize yes, dimensions no).
+- **Verify against live code:** `image-store.cjs`/`attachment-store.cjs` `put()` signatures (Task 2); the asset ingest handler path; FE `DataFieldWithUrl` + media-child download idiom for the current FE version (Task 4).
diff --git a/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase3-knowledge-graph.md b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase3-knowledge-graph.md
new file mode 100644
index 000000000..2fec35da6
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-31-tutorials-admin-op-phase3-knowledge-graph.md
@@ -0,0 +1,268 @@
+# Tutorials Admin OP — Phase 3 (Knowledge-Graph Facet) Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Surface per-tutorial knowledge-graph data on the Tutorials Object Page — concepts taught (with confidence), PageRank importance, community label, and co-completed neighbor tutorials — all read-only from data already populated by nightly jobs.
+
+**Architecture:** These entities (`TutorialConceptLinks`, `TutorialRank`, `CoCompletions`, `KgCommunity`/`KgCommunityLabel`) live on `KnowledgeGraphService`, not `AdminService`. Add `@readonly` projections on `AdminService` + associations from `Tutorials`, then a "Knowledge Graph" facet group. Purely additive and read-only; no pipeline changes. Reads fail-open (any SELECT throw leaves fields unset — FE renders nothing rather than 500), mirroring the existing KG `after('READ')` decorators.
+
+**Tech Stack:** SAP CAP (Node.js, CDS), Fiori Elements annotations, Vitest. KG data populated by existing nightly jobs (PageRank #916, WCC #918, Louvain #917, community labels #1126).
+
+**Spec:** `docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md` (§WS4)
+
+## Global Constraints
+
+- **Read-only, additive** — `@readonly` projections; `@cds.redirection.target: false` (pattern `srv/admin-service.cds:114,120`) to avoid stealing redirects.
+- **Fail-open reads** — if a KG projection can throw at read time, guard with an `after('READ')` that leaves fields unset (mirror `KnowledgeGraphService.Concepts`/`AdminService.Tutorials` isolation decorators). Pure associations/projections need no decorator.
+- **No new env flags, no schema, no jobs** — data already materialized.
+- **DEV-only until PROD KG data verifies** — same posture as #1126 (PROD Louvain/community data may be sparse; empty facets render as FE "No data", never a 500).
+- **Namespace** — KG entities are in the `com.sap.developers.ims` model (via `db/knowledge-graph*.cds`); some carry `@cds.autoexpose:false` (e.g. `TutorialRank`) requiring explicit projection.
+- **Tests:** `npm test` (unit), `npm run test:hybrid`. PR targets DEV.
+
+## File Structure
+
+- Modify: `srv/admin-service.cds` — `@readonly` projections (`TutorialConceptLinks`, `TutorialRank`, `CoCompletions`) + associations (`conceptLinks`, `rank`, `coCompletions`) on `Tutorials`; community label reachable via existing `KgCommunityMembers` (`:1249`) join.
+- Modify: `srv/admin-service.js` — optional fail-open `after('READ','Tutorials')` if a computed field is added (community label flatten).
+- Modify: `app/admin-annotations.cds` — Knowledge Graph facet group (concepts taught LineItem, prerequisites, PageRank + community FieldGroup, co-completed neighbors LineItem).
+- Test: `test/unit/kg-exposure.test.js`, `test/unit/annotations-kg.test.js`, `test/hybrid/kg-facet.test.js`.
+
+---
+
+### Task 1: Expose read-only KG projections + associations
+
+**Files:**
+- Modify: `srv/admin-service.cds`
+- Test: `test/unit/kg-exposure.test.js`
+
+**Interfaces:**
+- Consumes: `ims.TutorialConceptLinks` (`db/knowledge-graph.cds:61-70`, predicate teaches/extends + confidence), `ims.TutorialRank` (`:196-200`, PageRank score, `@cds.autoexpose:false`), `ims.CoCompletions` (`:158-162`, weighted A→B).
+- Produces: `AdminService.TutorialConceptLinks`, `AdminService.TutorialRank`, `AdminService.CoCompletions` (`@readonly`); `Tutorials.conceptLinks` (many), `Tutorials.rank` (one), `Tutorials.coCompletions` (many).
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/kg-exposure.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('KG exposure on AdminService', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('exposes concept links, rank, co-completions read-only', () => {
+    expect(m.definitions['AdminService.TutorialConceptLinks']).toBeTruthy()
+    expect(m.definitions['AdminService.TutorialRank']).toBeTruthy()
+    expect(m.definitions['AdminService.CoCompletions']).toBeTruthy()
+  })
+  it('Tutorials carries conceptLinks / rank / coCompletions', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.conceptLinks).toBeTruthy()
+    expect(t.rank).toBeTruthy()
+    expect(t.coCompletions).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — `npx vitest run test/unit/kg-exposure.test.js --project unit` → FAIL.
+
+> **Before implementing:** confirm exact entity + element names in `db/knowledge-graph.cds` — the join columns on `TutorialConceptLinks` (which side is the tutorial: `tutorial`/`source`), `TutorialRank` key/score field name (`score`/`pagerank`), and `CoCompletions` columns (`tutorialA`/`tutorialB`/`weight`). Adapt the `on` conditions below to the real names.
+
+- [ ] **Step 3: Implement**
+
+In `srv/admin-service.cds`:
+
+```cds
+@readonly @cds.redirection.target: false entity TutorialConceptLinks as projection on ims.TutorialConceptLinks;
+@readonly @cds.redirection.target: false entity TutorialRank         as projection on ims.TutorialRank;
+@readonly @cds.redirection.target: false entity CoCompletions        as projection on ims.CoCompletions;
+```
+
+Add to the `Tutorials` projection body (adapt `on` to confirmed column names):
+
+```cds
+conceptLinks  : Association to many TutorialConceptLinks on conceptLinks.tutorial = $self;
+rank          : Association to one  TutorialRank         on rank.tutorial = $self;
+coCompletions : Association to many CoCompletions        on coCompletions.tutorialA = $self;
+```
+
+> If `Tutorials.conceptLinks` is already injected on the db entity (`db/knowledge-graph.cds:94-97`), the `*` in the projection may already carry it — in that case only expose the target projection and drop the redundant association line. Verify with the failing test after each change.
+
+- [ ] **Step 4: Run to verify it passes** — test PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/admin-service.cds test/unit/kg-exposure.test.js
+git commit -m "feat(admin): read-only KG projections + Tutorials associations (#WS4)"
+```
+
+### Task 2: Community label reachable on the OP
+
+**Files:**
+- Modify: `srv/admin-service.cds` (association to community membership/label) + optional `srv/admin-service.js` fail-open decorator
+- Test: `test/unit/kg-community-link.test.js`
+
+**Interfaces:**
+- Consumes: `AdminService.KgCommunityMembers` (already exposed `:1249`), `KgCommunityLabel` (`db/knowledge-graph-communities.cds:76-83`, keyed by `communityFingerprint`).
+- Produces: a way to show the tutorial's community label on the OP — either an association `communityMembership` on `Tutorials` (many, filtered to this tutorial's slug) rendered as a small LineItem, or a flattened `virtual communityLabel` populated fail-open in `after('READ','Tutorials')`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/kg-community-link.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('community label reachable', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('Tutorials exposes community membership or virtual label', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.communityMembership || t.communityLabel).toBeTruthy()
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement (prefer the association — no compute, lowest risk)**
+
+In `srv/admin-service.cds`, add an association from `Tutorials` to the exposed community-member rows for this tutorial's slug (adapt column names to `KgCommunityMembers`):
+
+```cds
+communityMembership : Association to many KgCommunityMembers on communityMembership.memberSlug = $self.slug;
+```
+
+> If `KgCommunityMembers` does not carry a `memberSlug`/label directly, add a `virtual communityLabel : String` and populate it fail-open in `srv/admin-service.js` `after('READ','Tutorials')`:
+> ```js
+> srv.after('READ', 'Tutorials', async (rows) => {
+>   try { /* look up KgCommunity by slug → KgCommunityLabel; set r.communityLabel */ }
+>   catch (e) { /* fail-open: leave unset */ }
+> })
+> ```
+> Choose the association path if the columns allow; only fall back to the virtual+decorator if a join isn't expressible.
+
+- [ ] **Step 4: Run to verify it passes** — → PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/admin-service.cds srv/admin-service.js test/unit/kg-community-link.test.js
+git commit -m "feat(admin): expose community membership/label on Tutorials (#WS4)"
+```
+
+### Task 3: UI — Knowledge Graph facet group
+
+**Files:**
+- Modify: `app/admin-annotations.cds`
+- Test: `test/unit/annotations-kg.test.js`
+
+**Interfaces:**
+- Consumes: Task 1 + Task 2 associations/projections.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/annotations-kg.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('Knowledge Graph facets', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('OP facets include KG facets', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('ConceptsTaughtFacet')
+    expect(ids).toContain('CoCompletionsFacet')
+  })
+  it('concept links LineItem shows predicate + confidence', () => {
+    const li = m.definitions['AdminService.TutorialConceptLinks']['@UI.LineItem']
+    const vals = li.map((x) => x.Value?.['='] || x.Value)
+    expect(vals).toContain('predicate')
+    expect(vals).toContain('confidence')
+  })
+})
+```
+
+- [ ] **Step 2: Run to verify it fails** — → FAIL.
+
+- [ ] **Step 3: Implement**
+
+In `app/admin-annotations.cds` (adapt element names to confirmed schema):
+
+```cds
+annotate AdminService.TutorialConceptLinks with @(
+  UI.LineItem: [
+    { Value: concept_ID, Label: 'Concept' },
+    { Value: predicate,  Label: 'Relation' },   // teaches | extends
+    { Value: confidence, Label: 'Confidence' }
+  ]
+);
+annotate AdminService.CoCompletions with @(
+  UI.LineItem: [
+    { Value: tutorialB_ID, Label: 'Also Completed' },
+    { Value: weight,       Label: 'Weight' }
+  ]
+);
+```
+
+Add a "Knowledge Graph" FieldGroup for PageRank + community, and facets to the winning `@UI.Facets` block:
+
+```cds
+annotate AdminService.Tutorials with @(
+  UI.FieldGroup #KnowledgeGraph: { Data: [
+    { Value: rank.score,       Label: 'PageRank' },
+    { Value: communityLabel,   Label: 'Community' }   // or a nested membership ref
+  ]}
+);
+// facets:
+{ $Type: 'UI.ReferenceFacet', Label: 'Knowledge Graph', ID: 'KgFieldsFacet', Target: '@UI.FieldGroup#KnowledgeGraph' },
+{ $Type: 'UI.ReferenceFacet', Label: 'Concepts Taught', ID: 'ConceptsTaughtFacet', Target: 'conceptLinks/@UI.LineItem' },
+{ $Type: 'UI.ReferenceFacet', Label: 'Co-Completed', ID: 'CoCompletionsFacet', Target: 'coCompletions/@UI.LineItem' },
+```
+
+> `rank.score` path-navigation in a FieldGroup requires the to-one `rank` association from Task 1; if FE rejects the deep path, expose a flattened `virtual pageRank : Decimal` on `Tutorials` populated fail-open in `after('READ')` instead.
+
+- [ ] **Step 4: Run to verify it passes** — → PASS; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] **Step 5: Commit**
+
+```bash
+git add app/admin-annotations.cds test/unit/annotations-kg.test.js
+git commit -m "feat(admin-ui): Knowledge Graph facet (concepts/PageRank/community/co-completions) (#WS4)"
+```
+
+### Task 4: Hybrid guard — KG facet reads fail-open
+
+**Files:**
+- Test: `test/hybrid/kg-facet.test.js`
+
+- [ ] **Step 1: Write the hybrid test**
+
+```js
+// test/hybrid/kg-facet.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('KG facet reads (hybrid)', () => {
+  let admin; beforeAll(async () => { admin = await cds.connect.to('AdminService') })
+  it('reads a tutorial with KG associations expanded without error', async () => {
+    const t = await admin.run(SELECT.one.from('AdminService.Tutorials').columns('ID','slug'))
+    expect(t).toBeTruthy()
+    const links = await admin.run(SELECT.from('AdminService.TutorialConceptLinks').where({ tutorial_ID: t.ID }))
+    expect(Array.isArray(links)).toBe(true)          // may be empty in DEV — that's fine
+    const co = await admin.run(SELECT.from('AdminService.CoCompletions').limit(1))
+    expect(Array.isArray(co)).toBe(true)
+  })
+})
+```
+
+- [ ] **Step 2: Run** `npm run test:hybrid -- test/hybrid/kg-facet.test.js` → PASS (empty arrays acceptable).
+- [ ] **Step 3: Commit**
+
+```bash
+git add test/hybrid/kg-facet.test.js
+git commit -m "test(kg): hybrid guard for KG facet reads (#WS4)"
+```
+
+---
+
+## Final verification
+
+- [ ] `npm test` all green; `npx cds deploy --to sqlite::memory:` clean.
+- [ ] DEV post-deploy: reference tutorial OP shows a Knowledge Graph facet — concepts taught with confidence, PageRank + community label, co-completed neighbors. Empty sections render as FE "No data" (never a 500).
+- [ ] PR targets DEV. Note: DEV-only until PROD Louvain/community data verifies (#1126 posture).
+
+## Self-review notes
+
+- **Spec coverage:** WS4 concepts/prerequisites (Task 1/3), PageRank (Task 1/3), community label (Task 2/3), co-completed neighbors (Task 1/3).
+- **Verify against live code before writing each task:** exact `TutorialConceptLinks` join column (`tutorial` vs `source`) + `predicate`/`confidence` names; `TutorialRank` score field name; `CoCompletions` column names (`tutorialA`/`tutorialB`/`weight`); whether `Tutorials.conceptLinks` is already carried via the db-entity injection (`db/knowledge-graph.cds:94-97`); whether `KgCommunityMembers` exposes a slug/label to associate on. Each is grounded by the inventory research but must be confirmed at the touched lines. Prefer associations over computed virtuals; only add a fail-open `after('READ')` decorator where a join isn't expressible.
diff --git a/docs/superpowers/plans/2026-09-01-tag-tree-topics.md b/docs/superpowers/plans/2026-09-01-tag-tree-topics.md
new file mode 100644
index 000000000..6856c3ec4
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-01-tag-tree-topics.md
@@ -0,0 +1,1371 @@
+# Tag-Tree Topics Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Rebuild `/topics/` as a first-class CAP-served subsystem with the same technical quality as `/concepts/` — stable SAP-tag-hierarchy slugs, a server-rendered tree index + progressive island, deterministically-populated concepts, working search, and dynamic per-slug HANA-blob serving.
+
+**Architecture:** A topic = a live SAP tag (a tag applied to ≥1 tutorial). Two JSON build feeds (`/build/topics-tree`, `/build/topics/:slug`) assemble data directly from `Tags`/`TutorialTags`/`TutorialConceptLinks`. A CAP index renderer (`topic-list-page.js` → `/content/topics-index`) and detail renderer (`topic-detail-render.js`, published as `topic-<slug>` HANA blobs) mirror the concepts subsystem exactly, wrapped in the shared chrome shell. The approuter gains `^/topics/(.*)$` + `^/topics/?$` dynamic routes and a `/search/` → `/tutorial-navigator/` redirect. Legacy `topics_gallery`/Hugo topics section is retired.
+
+**Tech Stack:** SAP CAP (Node.js, `@sap/cds`), Express handlers, Hugo, Vue 3 island (`hugo-apps/`, Vite), HANA content blobs (gzip), AppRouter (`xs-app.json`), Vitest (`cds.test`).
+
+**Spec:** `docs/superpowers/specs/2026-09-01-tag-tree-topics-design.md`
+
+## Global Constraints
+
+- **PRs target `DEV`; `main` is protected — no direct-to-main path.** Branch off `origin/DEV`. This worktree is already rebased onto `origin/DEV`.
+- **Never write raw SQL** — use `cds.ql`/CQL. Exception: reading HANA BLOBs alongside metadata (use raw `db.run()` per the BLOB-locator rule); topic payload queries touch no BLOBs, so CQL applies throughout the query layer.
+- **Never SELECT a HANA BLOB alongside metadata in one CDS QL query.** The publish/serve blob paths reuse the existing concepts blob helpers (`composeShell`, session helpers) which already obey this.
+- **Resolve entities via `cds.entities(NS)`** with `NS = 'com.sap.developers.ims'`, not bare `SELECT.from('X')` (CI Node 22 vs local Node 24 drift).
+- **HANA stores columns UPPERCASE**; junction FK columns are `tutorial_ID`, `tag_ID`, `concept_ID`. Query via entity refs + CQL (CAP maps casing), never hand-cased raw SQL here.
+- **`srv/lib/*` reachable from `content-store.js` must be in `.deploy/mta.yaml`'s `srv-qa` `cp` list**, with transitive `./` imports re-walked (Task 12).
+- **Never `publish-content` from a workstation** — topic blobs publish via `gh workflow run rebuild-content.yml`. Local verification uses `/build/topics/:slug` JSON + hybrid tests.
+- **Fail-open everywhere:** empty `TutorialConceptLinks`/`Tags` → empty payload + `error` field, never a 500. Mirrors `build-topics-gallery.js` posture.
+- **Tutorial slugs are lowercase canonical** — `.toLowerCase()` tutorial slugs before emitting hrefs.
+- **Test bootstrap:** `cds.test('serve', …, '--in-memory')` — NOT `cds.deploy(cds.model)` (broken in unit tests).
+- **Pre-commit for any `db/**/*.cds` change:** `npx cds deploy --to sqlite::memory:`. (This plan adds NO new CDS entities — all sources already exist.)
+- **Address the user as Tom.**
+
+---
+
+## File Structure
+
+**New files:**
+- `srv/lib/topic-slug.js` — pure slug flatten / collision-qualify / legacy-normalize utilities.
+- `srv/lib/topics-query.js` — data assemblers: `buildTopicsTreePayload(db)`, `buildTopicDetailPayload(db, slug)`, `resolveTopicBySlug`.
+- `srv/lib/build-topics.js` — Express JSON feed handlers `buildTopicsTreeHandler`, `buildTopicDetailHandler` (mirrors `build-concepts.js`).
+- `srv/lib/topic-list-page.js` — CAP index renderer + `topicsIndexHandler` (mirrors `concept-list-page.js`).
+- `srv/lib/topic-detail-render.js` — `renderTopicDetail(topic)` → `{body, contentHash}` (mirrors `concept-detail-render.js`).
+- `srv/lib/publish-topics.js` — `renderTopicsIntoSession(...)` blob publisher (mirrors `publish-concepts.js`).
+- `hugo-apps/src/topics-tree/main.ts` + `App.vue` — progressive-enhancement island.
+- `test/unit/topic-slug.test.js`, `test/unit/topics-query.test.js`, `test/unit/topic-list-page.test.js` — unit tests.
+- `test/hybrid/topics-publish-serve.test.js` — hybrid round-trip.
+- `test/e2e/topics.spec.ts` — post-deploy e2e.
+
+**Modified files:**
+- `srv/server.js` — register 4 routes.
+- `srv/lib/page-key-map.js` — add `TOPIC_KEY_PREFIX` + `discoverTopicPages`.
+- `scripts/publish-content.ts` — call `discoverTopicPages` in the non-slug publish path.
+- `approuter/xs-app.json` — topics detail/index routes, `topics-tree` build allow-list, `/search/` redirect.
+- `hugo/layouts/topics/list.html` — repoint search form (interim, before section retirement).
+- `.deploy/mta.yaml` — `srv-qa` `cp` list.
+- `hugo-apps/vite.config.ts` — register `topics-tree` island entry.
+- **Deletions (Task 11):** `hugo/content/topics/btp-basics.md`, `hugo/content/topics/cap-fundamentals.md`, `hugo/layouts/topics/list.html`, `hugo/layouts/topics/single.html`, `hugo/data/topics_gallery.json`, `scripts/fetch-topics-gallery.ts`, and orphaned tests referencing them.
+
+---
+
+## Task 1: Pure slug utilities (`srv/lib/topic-slug.js`)
+
+**Files:**
+- Create: `srv/lib/topic-slug.js`
+- Test: `test/unit/topic-slug.test.js`
+
+**Interfaces:**
+- Produces:
+  - `flattenTopicSlug(value: string): string` — `'sap-hana-cloud--data-lake'` → `'sap-hana-cloud-data-lake'`.
+  - `buildTopicSlugMap(liveTags: Array<{titlePath, label, tutorialCount, conceptCount}>): { bySlug: Map<string, Tag>, byTag: Map<string, string> }` — deterministic collision-qualify.
+  - `normalizeLegacyTopicSlug(slug: string): string` — strips a single trailing `-<digits>` disambiguator.
+  - `parseTitlePath(titlePath: string): { facet: string, value: string, segments: string[] }`.
+  - `Tag` shape: `{ titlePath, facet, value, segments, slug, label, tutorialCount, conceptCount }`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/topic-slug.test.js
+import { describe, it, expect } from 'vitest';
+import {
+  flattenTopicSlug, parseTitlePath, buildTopicSlugMap, normalizeLegacyTopicSlug,
+} from '../../srv/lib/topic-slug.js';
+
+describe('flattenTopicSlug', () => {
+  it('collapses -- and lowercases', () => {
+    expect(flattenTopicSlug('sap-hana-cloud--data-lake')).toBe('sap-hana-cloud-data-lake');
+    expect(flattenTopicSlug('SAP-HANA-Cloud')).toBe('sap-hana-cloud');
+  });
+});
+
+describe('parseTitlePath', () => {
+  it('splits facet, value and -- segments', () => {
+    expect(parseTitlePath('software-product-function>sap-hana-cloud--data-lake')).toEqual({
+      facet: 'software-product-function',
+      value: 'sap-hana-cloud--data-lake',
+      segments: ['sap-hana-cloud', 'data-lake'],
+    });
+  });
+});
+
+describe('buildTopicSlugMap', () => {
+  it('qualifies collisions with facet, first-by-titlePath wins bare', () => {
+    const { bySlug } = buildTopicSlugMap([
+      { titlePath: 'software-product>foo-bar', label: 'A' },
+      { titlePath: 'topic>foo--bar', label: 'B' }, // also flattens to foo-bar
+    ]);
+    expect(bySlug.has('foo-bar')).toBe(true);          // software-product wins (sorts first)
+    expect(bySlug.get('foo-bar').label).toBe('A');
+    expect(bySlug.has('topic-foo-bar')).toBe(true);    // loser facet-qualified
+    expect(bySlug.get('topic-foo-bar').label).toBe('B');
+  });
+});
+
+describe('normalizeLegacyTopicSlug', () => {
+  it('strips a trailing numeric disambiguator', () => {
+    expect(normalizeLegacyTopicSlug('sap-hana-smart-data-streaming-development-2'))
+      .toBe('sap-hana-smart-data-streaming-development');
+    expect(normalizeLegacyTopicSlug('sap-hana-cloud')).toBe('sap-hana-cloud');
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/unit/topic-slug.test.js --project unit`
+Expected: FAIL — module not found / functions undefined.
+
+- [ ] **Step 3: Write minimal implementation**
+
+```js
+// srv/lib/topic-slug.js
+export function flattenTopicSlug(value) {
+  return String(value).replace(/--/g, '-').toLowerCase();
+}
+
+export function parseTitlePath(titlePath) {
+  const idx = String(titlePath).indexOf('>');
+  const facet = idx === -1 ? '' : titlePath.slice(0, idx);
+  const value = idx === -1 ? titlePath : titlePath.slice(idx + 1);
+  return { facet, value, segments: value.split('--') };
+}
+
+// Deterministic: sort by titlePath, first occupant of a slug keeps it bare;
+// later collisions are facet-qualified `<facet>-<slug>`.
+export function buildTopicSlugMap(liveTags) {
+  const bySlug = new Map();
+  const byTag = new Map();
+  const sorted = [...liveTags].sort((a, b) => a.titlePath.localeCompare(b.titlePath));
+  for (const raw of sorted) {
+    const { facet, value, segments } = parseTitlePath(raw.titlePath);
+    const base = flattenTopicSlug(value);
+    let slug = base;
+    if (bySlug.has(slug)) slug = `${facet}-${base}`;
+    // If even the qualified slug collides, suffix an index (defensive; asserted-rare).
+    let n = 2;
+    while (bySlug.has(slug)) slug = `${facet}-${base}-${n++}`;
+    const tag = {
+      titlePath: raw.titlePath, facet, value, segments, slug,
+      label: raw.label || segments[segments.length - 1],
+      tutorialCount: raw.tutorialCount ?? 0,
+      conceptCount: raw.conceptCount ?? 0,
+    };
+    bySlug.set(slug, tag);
+    byTag.set(raw.titlePath, slug);
+  }
+  return { bySlug, byTag };
+}
+
+export function normalizeLegacyTopicSlug(slug) {
+  return String(slug).replace(/-\d+$/, '');
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/unit/topic-slug.test.js --project unit`
+Expected: PASS (4 suites).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/topic-slug.js test/unit/topic-slug.test.js
+git commit -m "feat(topics): pure slug flatten + collision-qualify + legacy-normalize"
+```
+
+---
+
+## Task 2: Data assemblers (`srv/lib/topics-query.js`)
+
+**Files:**
+- Create: `srv/lib/topics-query.js`
+- Test: `test/unit/topics-query.test.js`
+
+**Interfaces:**
+- Consumes: `flattenTopicSlug`, `parseTitlePath`, `buildTopicSlugMap`, `normalizeLegacyTopicSlug` (Task 1).
+- Produces:
+  - `loadLiveTags(db): Promise<Tag[]>` — tags applied to ≥1 tutorial, with `tutorialCount` + `conceptCount`.
+  - `buildTopicsTreePayload(db): Promise<{ tree, buildAt, error }>` where `tree = [{ facet, label, children: TreeNode[] }]`, `TreeNode = { segment, label, slug?, tutorialCount?, conceptCount?, children: TreeNode[] }`.
+  - `resolveTopicBySlug(db, slug): Promise<{ tag: Tag|null, redirectTo: string|null }>` — legacy `-N` strip + facet-qualify resolution.
+  - `buildTopicDetailPayload(db, slug): Promise<{ slug, label, facet, tutorials, concepts, relatedTags, buildAt, error, notFound?, redirectTo? }>`.
+  - `tutorials[]` = `{ slug, title, level, time, href, isNew }`; `concepts[]` = `{ slug, name, rank }`; `relatedTags[]` = `{ slug, label }`.
+
+**Reference to mirror:** tag→tutorial join pattern `srv/lib/kg-projection.js:1027-1038`; unbounded-fetch-filter-in-Node HANA pattern `srv/lib/published-concepts-query.js:78-92`; teaches-link join `published-concepts-query.js:95-104`.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/topics-query.test.js
+import { describe, it, beforeAll, expect } from 'vitest';
+import cds from '@sap/cds';
+import {
+  loadLiveTags, buildTopicsTreePayload, resolveTopicBySlug, buildTopicDetailPayload,
+} from '../../srv/lib/topics-query.js';
+
+const NS = 'com.sap.developers.ims';
+
+describe('topics-query', () => {
+  let db;
+  beforeAll(async () => {
+    await cds.test('serve', '--in-memory', '--project', process.cwd());
+    db = await cds.connect.to('db');
+    const { Tutorials, Tags, TutorialTags, TutorialConceptLinks, Concepts } = cds.entities(NS);
+    await db.run(INSERT.into(Tags).entries([
+      { ID: 't1', titlePath: 'software-product>sap-hana-cloud', label: 'SAP HANA Cloud', name: 'sap-hana-cloud' },
+      { ID: 't2', titlePath: 'software-product-function>sap-hana-cloud--data-lake', label: 'Data Lake', name: 'sap-hana-cloud--data-lake' },
+    ]));
+    await db.run(INSERT.into(Tutorials).entries([
+      { ID: 'tut1', slug: 'hana-intro', title: 'HANA Intro', experienceTag: 'Beginner' },
+    ]));
+    await db.run(INSERT.into(TutorialTags).entries([
+      { tutorial_ID: 'tut1', tag_ID: 't1' },
+    ]));
+    await db.run(INSERT.into(Concepts).entries([
+      { ID: 'c1', slug: 'in-memory-database', name: 'In-Memory Database', status: 'ACTIVE', publishedAt: new Date().toISOString() },
+    ]));
+    await db.run(INSERT.into(TutorialConceptLinks).entries([
+      { ID: 'l1', tutorial_ID: 'tut1', concept_ID: 'c1', predicate: 'teaches' },
+    ]));
+  });
+
+  it('loadLiveTags returns only tags with ≥1 tutorial, with counts', async () => {
+    const live = await loadLiveTags(db);
+    const slugs = live.map(t => t.slug).sort();
+    expect(slugs).toContain('sap-hana-cloud');
+    expect(slugs).not.toContain('sap-hana-cloud-data-lake'); // t2 has no tutorial
+    const hana = live.find(t => t.slug === 'sap-hana-cloud');
+    expect(hana.tutorialCount).toBe(1);
+    expect(hana.conceptCount).toBe(1);
+  });
+
+  it('buildTopicsTreePayload groups by facet', async () => {
+    const { tree, error } = await buildTopicsTreePayload(db);
+    expect(error).toBeFalsy();
+    const facet = tree.find(f => f.facet === 'software-product');
+    expect(facet.children.some(n => n.slug === 'sap-hana-cloud')).toBe(true);
+  });
+
+  it('buildTopicDetailPayload returns tutorials + concepts', async () => {
+    const p = await buildTopicDetailPayload(db, 'sap-hana-cloud');
+    expect(p.notFound).toBeFalsy();
+    expect(p.tutorials.map(t => t.slug)).toContain('hana-intro');
+    expect(p.concepts.map(c => c.slug)).toContain('in-memory-database');
+  });
+
+  it('resolveTopicBySlug strips legacy -N and redirects', async () => {
+    const r = await resolveTopicBySlug(db, 'sap-hana-cloud-2');
+    expect(r.tag?.slug).toBe('sap-hana-cloud');
+    expect(r.redirectTo).toBe('/topics/sap-hana-cloud/');
+  });
+
+  it('unknown slug is notFound with redirect to /topics/', async () => {
+    const p = await buildTopicDetailPayload(db, 'does-not-exist');
+    expect(p.notFound).toBe(true);
+    expect(p.redirectTo).toBe('/topics/');
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/unit/topics-query.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Write minimal implementation**
+
+```js
+// srv/lib/topics-query.js
+import cds from '@sap/cds';
+import { buildTopicSlugMap, parseTitlePath, normalizeLegacyTopicSlug } from './topic-slug.js';
+
+const NS = 'com.sap.developers.ims';
+const MAX_TUTORIALS = 60;
+const MAX_CONCEPTS = 24;
+
+function ent() {
+  const { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank } = cds.entities(NS);
+  return { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank };
+}
+
+function humanizeFacet(facet) {
+  return String(facet).split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+}
+
+// Live-tag set (applied to ≥1 tutorial) with per-tag tutorial + concept counts.
+export async function loadLiveTags(db) {
+  const { Tags, TutorialTags, TutorialConceptLinks } = ent();
+  const tags = await db.run(SELECT.from(Tags).columns('ID', 'titlePath', 'label', 'name'));
+  const tagById = new Map(tags.map(t => [t.ID, t]));
+  const links = await db.run(SELECT.from(TutorialTags).columns('tutorial_ID', 'tag_ID'));
+
+  const tutorialIdsByTag = new Map(); // tag_ID -> Set(tutorial_ID)
+  for (const l of links) {
+    if (!tagById.has(l.tag_ID)) continue;
+    (tutorialIdsByTag.get(l.tag_ID) ?? tutorialIdsByTag.set(l.tag_ID, new Set()).get(l.tag_ID)).add(l.tutorial_ID);
+  }
+
+  // Bulk teaches-links → tutorial_ID -> Set(concept_ID); unbounded fetch, filter in Node.
+  const teaches = await db.run(
+    SELECT.from(TutorialConceptLinks).columns('tutorial_ID', 'concept_ID').where({ predicate: 'teaches' }),
+  );
+  const conceptsByTutorial = new Map();
+  for (const t of teaches) {
+    if (!t.concept_ID) continue;
+    (conceptsByTutorial.get(t.tutorial_ID) ?? conceptsByTutorial.set(t.tutorial_ID, new Set()).get(t.tutorial_ID)).add(t.concept_ID);
+  }
+
+  const liveRaw = [];
+  for (const [tagId, tutSet] of tutorialIdsByTag) {
+    const tag = tagById.get(tagId);
+    if (!tag?.titlePath) continue;
+    const conceptSet = new Set();
+    for (const tutId of tutSet) for (const c of (conceptsByTutorial.get(tutId) ?? [])) conceptSet.add(c);
+    liveRaw.push({ titlePath: tag.titlePath, label: tag.label, tutorialCount: tutSet.size, conceptCount: conceptSet.size });
+  }
+  const { bySlug } = buildTopicSlugMap(liveRaw);
+  return [...bySlug.values()];
+}
+
+export async function buildTopicsTreePayload(db) {
+  try {
+    const live = await loadLiveTags(db);
+    const facets = new Map(); // facet -> node
+    for (const tag of live) {
+      if (!facets.has(tag.facet)) facets.set(tag.facet, { facet: tag.facet, label: humanizeFacet(tag.facet), children: [] });
+      const facetNode = facets.get(tag.facet);
+      let level = facetNode.children;
+      for (let i = 0; i < tag.segments.length; i++) {
+        const seg = tag.segments[i];
+        let node = level.find(n => n.segment === seg);
+        if (!node) { node = { segment: seg, label: seg, children: [] }; level.push(node); }
+        if (i === tag.segments.length - 1) {
+          node.slug = tag.slug;
+          node.label = tag.label || seg;
+          node.tutorialCount = tag.tutorialCount;
+          node.conceptCount = tag.conceptCount;
+        }
+        level = node.children;
+      }
+    }
+    const sortRec = (nodes) => {
+      nodes.sort((a, b) => a.label.localeCompare(b.label));
+      for (const n of nodes) sortRec(n.children);
+    };
+    const tree = [...facets.values()].sort((a, b) => a.label.localeCompare(b.label));
+    for (const f of tree) sortRec(f.children);
+    return { tree, buildAt: new Date().toISOString(), error: null };
+  } catch (err) {
+    return { tree: [], buildAt: new Date().toISOString(), error: err.message };
+  }
+}
+
+export async function resolveTopicBySlug(db, slug) {
+  const live = await loadLiveTags(db);
+  const bySlug = new Map(live.map(t => [t.slug, t]));
+  if (bySlug.has(slug)) return { tag: bySlug.get(slug), redirectTo: null };
+  const base = normalizeLegacyTopicSlug(slug);
+  if (base !== slug && bySlug.has(base)) return { tag: bySlug.get(base), redirectTo: `/topics/${base}/` };
+  return { tag: null, redirectTo: '/topics/' };
+}
+
+export async function buildTopicDetailPayload(db, slug) {
+  try {
+    const { tag, redirectTo } = await resolveTopicBySlug(db, slug);
+    if (!tag) return { slug, notFound: true, redirectTo, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: null };
+    if (redirectTo) return { slug: tag.slug, notFound: false, redirectTo, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: null };
+
+    const { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank } = ent();
+
+    // tutorials carrying this tag
+    const tagRow = await db.run(SELECT.one.from(Tags).columns('ID').where({ titlePath: tag.titlePath }));
+    const ttRows = tagRow ? await db.run(SELECT.from(TutorialTags).columns('tutorial_ID').where({ tag_ID: tagRow.ID })) : [];
+    const tutIds = new Set(ttRows.map(r => r.tutorial_ID));
+    const allTuts = await db.run(SELECT.from(Tutorials).columns('ID', 'slug', 'title', 'experienceTag', 'timeToComplete', 'isNew'));
+    const tutorials = allTuts
+      .filter(t => tutIds.has(t.ID))
+      .map(t => ({
+        slug: String(t.slug || '').toLowerCase(),
+        title: t.title,
+        level: t.experienceTag || null,
+        time: t.timeToComplete || null,
+        href: `/tutorials/${String(t.slug || '').toLowerCase()}/`,
+        isNew: !!t.isNew,
+      }))
+      .sort((a, b) => a.title.localeCompare(b.title))
+      .slice(0, MAX_TUTORIALS);
+
+    // concepts taught by those tutorials (unbounded fetch + Node filter)
+    const teaches = await db.run(SELECT.from(TutorialConceptLinks).columns('tutorial_ID', 'concept_ID').where({ predicate: 'teaches' }));
+    const conceptIds = new Set(teaches.filter(l => tutIds.has(l.tutorial_ID) && l.concept_ID).map(l => l.concept_ID));
+    const allConcepts = await db.run(SELECT.from(Concepts).columns('ID', 'slug', 'name').where({ status: 'ACTIVE' }));
+    const rankRows = await db.run(SELECT.from(ConceptRank).columns('slug', 'score')).catch(() => []);
+    const rankBySlug = new Map(rankRows.map(r => [r.slug, r.score]));
+    const concepts = allConcepts
+      .filter(c => conceptIds.has(c.ID))
+      .map(c => ({ slug: c.slug, name: c.name, rank: rankBySlug.get(c.slug) ?? 0 }))
+      .sort((a, b) => b.rank - a.rank || a.name.localeCompare(b.name))
+      .slice(0, MAX_CONCEPTS);
+
+    // related tags = same-facet siblings sharing the parent segment
+    const parent = tag.segments.slice(0, -1);
+    const relatedTags = live
+      .filter(t => t.slug !== tag.slug && t.facet === tag.facet)
+      .filter(t => parent.length === 0 || parent.every((seg, i) => t.segments[i] === seg))
+      .map(t => ({ slug: t.slug, label: t.label }))
+      .sort((a, b) => a.label.localeCompare(b.label))
+      .slice(0, 24);
+
+    return {
+      slug: tag.slug, label: tag.label, facet: tag.facet,
+      tutorials, concepts, relatedTags,
+      buildAt: new Date().toISOString(), error: null,
+    };
+  } catch (err) {
+    return { slug, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: err.message };
+  }
+}
+```
+
+> **NOTE for implementer:** verify the real column names on `Tutorials` before running — the recon confirmed `slug`, `title`, `experienceTag`, `stepCount`, `isNew`, `primaryTag`. Confirm the "time to complete" column name via `cds.entities(NS).Tutorials` (candidates: `timeToComplete`, `time`, `estimatedTime`); adjust the `.columns(...)` and mapping to the actual name. If absent, drop `time` from the projection.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/unit/topics-query.test.js --project unit`
+Expected: PASS (5 cases). Fix column-name mismatches surfaced here.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/topics-query.js test/unit/topics-query.test.js
+git commit -m "feat(topics): tree + detail data assemblers (tag-sourced, concept-enriched, fail-open)"
+```
+
+---
+
+## Task 3: JSON build feed handlers (`srv/lib/build-topics.js`)
+
+**Files:**
+- Create: `srv/lib/build-topics.js`
+
+**Interfaces:**
+- Consumes: `buildTopicsTreePayload`, `buildTopicDetailPayload` (Task 2).
+- Produces: `buildTopicsTreeHandler(req, res)`, `buildTopicDetailHandler(req, res)` — Express handlers.
+
+**Reference to mirror:** `srv/lib/build-concepts.js:11-22`.
+
+- [ ] **Step 1: Write the implementation**
+
+```js
+// srv/lib/build-topics.js
+import cds from '@sap/cds';
+import { buildTopicsTreePayload, buildTopicDetailPayload } from './topics-query.js';
+
+export async function buildTopicsTreeHandler(req, res) {
+  const db = await cds.connect.to('db');
+  const payload = await buildTopicsTreePayload(db);
+  res.set('Cache-Control', 'public, max-age=60');
+  res.json(payload);
+}
+
+export async function buildTopicDetailHandler(req, res) {
+  const db = await cds.connect.to('db');
+  const slug = String(req.params.slug || '').toLowerCase();
+  const payload = await buildTopicDetailPayload(db, slug);
+  res.set('Cache-Control', 'public, max-age=60');
+  res.status(payload.notFound ? 404 : 200).json(payload);
+}
+```
+
+- [ ] **Step 2: Commit** (registration + live verification happen in Task 8)
+
+```bash
+git add srv/lib/build-topics.js
+git commit -m "feat(topics): /build/topics-tree + /build/topics/:slug JSON feed handlers"
+```
+
+---
+
+## Task 4: CAP index renderer (`srv/lib/topic-list-page.js`)
+
+**Files:**
+- Create: `srv/lib/topic-list-page.js`
+- Test: `test/unit/topic-list-page.test.js`
+
+**Interfaces:**
+- Consumes: `buildTopicsTreePayload` (Task 2); `chrome-shell.js` exports `createShellLoader`, `composeShell`, `ShellMarkerError`; `edge-cache-headers.js` `setContentCacheHeaders`; `island-manifest.json`.
+- Produces:
+  - `buildTopicListModel(db, deps = {}): Promise<{ tree, version }>`.
+  - `renderTopicListBody(model): string` — BODY fragment: inline `<style>`, `<article class="topics-index" id="topics-tree-root">` with semantic nested `<ul>` + `<details>/<summary>`, embedded `<script type="application/json" id="topics-tree-data">`, and `<script type="module" src="${islandSrc('topics-tree')}" defer>`.
+  - `createTopicListPage({ namespace, deps } = {}): { topicsIndexHandler, _invalidate }`.
+  - Default export `topicsIndexHandler`.
+
+**Reference to mirror (read these exact ranges and copy the boilerplate):**
+- `srv/lib/concept-list-page.js:20-38` — `islandSrc` + imports.
+- `concept-list-page.js:239-334` — `createConceptListPage` factory: shell loader wiring, `getActiveVersion()`, version-keyed gzip+etag cache, 304 handling, `composeShell` wrap, `setContentCacheHeaders`, `X-Content-Source`, stale-cache-on-error → 503.
+- `srv/lib/chrome-shell.js:75-89` — **add a `topics-index` case to `canonicalUrlFor`** returning `/topics/` and a `topic` case returning `/topics/${slug}/`; **add the same two cases to `buildBreadcrumbJsonLd` (`chrome-shell.js:99-137`)**.
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/topic-list-page.test.js
+import { describe, it, expect } from 'vitest';
+import { renderTopicListBody } from '../../srv/lib/topic-list-page.js';
+
+describe('renderTopicListBody', () => {
+  const model = {
+    version: 'v1',
+    tree: [{
+      facet: 'software-product', label: 'Software Product',
+      children: [
+        { segment: 'sap-hana-cloud', slug: 'sap-hana-cloud', label: 'SAP HANA Cloud', tutorialCount: 3, conceptCount: 5, children: [
+          { segment: 'data-lake', slug: 'sap-hana-cloud-data-lake', label: 'Data Lake', tutorialCount: 1, conceptCount: 2, children: [] },
+        ] },
+      ],
+    }],
+  };
+  it('renders nested details/ul with topic links and no-JS disclosure', () => {
+    const html = renderTopicListBody(model);
+    expect(html).toContain('<details');
+    expect(html).toContain('<summary');
+    expect(html).toContain('href="/topics/sap-hana-cloud/"');
+    expect(html).toContain('href="/topics/sap-hana-cloud-data-lake/"');
+    expect(html).toContain('id="topics-tree-root"');
+  });
+  it('embeds the tree JSON and the island script', () => {
+    const html = renderTopicListBody(model);
+    expect(html).toContain('id="topics-tree-data"');
+    expect(html).toMatch(/<script type="module" src="[^"]+" defer>/);
+    // JSON must be HTML-safe
+    expect(html).not.toContain('</script></script>');
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/unit/topic-list-page.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Write minimal implementation**
+
+```js
+// srv/lib/topic-list-page.js
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+import cds from '@sap/cds';
+import { createShellLoader, ShellMarkerError, composeShell } from './chrome-shell.js';
+import { buildTopicsTreePayload } from './topics-query.js';
+import { setContentCacheHeaders } from './edge-cache-headers.js';
+
+const _dir = dirname(fileURLToPath(import.meta.url));
+let _islandManifest;
+function islandSrc(name) {
+  if (!_islandManifest) {
+    try { _islandManifest = JSON.parse(readFileSync(join(_dir, 'island-manifest.json'), 'utf8')); }
+    catch { _islandManifest = {}; }
+  }
+  return _islandManifest[name] ?? `/js/${name}.js`;
+}
+
+const DEFAULT_NAMESPACE = 'com.sap.developers.ims';
+const HANA_TABLE = 'com_sap_developers_ims_ContentFiles';
+const HANA_CURRENT_TABLE = 'com_sap_developers_ims_ContentCurrent';
+
+const TOPICS_STYLE = `<style>
+.topics-index{max-width:64rem;margin:0 auto;padding:1rem}
+.topics-index details{margin:.25rem 0}
+.topics-index summary{cursor:pointer;font-weight:600}
+.topics-index ul{list-style:none;padding-left:1.25rem;margin:.25rem 0}
+.topics-index__count{color:#556;font-size:.85em;margin-left:.4em}
+.topics-index__filter{width:100%;max-width:28rem;padding:.5rem;margin:.5rem 0}
+</style>`;
+
+function esc(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+function jsonForScript(obj) {
+  return JSON.stringify(obj).replace(/</g, '\\u003c');
+}
+
+function renderNode(node) {
+  const count = node.slug
+    ? `<span class="topics-index__count">${node.tutorialCount ?? 0} tutorials · ${node.conceptCount ?? 0} concepts</span>`
+    : '';
+  const label = node.slug
+    ? `<a href="/topics/${esc(node.slug)}/">${esc(node.label)}</a>${count}`
+    : `${esc(node.label)}`;
+  if (node.children && node.children.length) {
+    return `<li><details><summary>${label}</summary><ul>${node.children.map(renderNode).join('')}</ul></details></li>`;
+  }
+  return `<li>${label}</li>`;
+}
+
+export function renderTopicListBody(model) {
+  const facets = (model.tree || []).map(f =>
+    `<li><details open><summary>${esc(f.label)}</summary><ul>${f.children.map(renderNode).join('')}</ul></details></li>`,
+  ).join('');
+  const data = jsonForScript({ tree: model.tree || [] });
+  return `${TOPICS_STYLE}
+<article class="topics-index" id="topics-tree-root">
+  <h1>Explore topics</h1>
+  <input type="search" class="topics-index__filter" id="topics-filter-input"
+    placeholder="Filter topics…" aria-label="Filter topics">
+  <ul>${facets}</ul>
+  <p><a href="/tutorial-navigator/">Search all tutorials →</a></p>
+</article>
+<script type="application/json" id="topics-tree-data">${data}</script>
+<script type="module" src="${islandSrc('topics-tree')}" defer></script>`;
+}
+
+export async function buildTopicListModel(db, _deps = {}) {
+  const payload = await buildTopicsTreePayload(db);
+  return { tree: payload.tree || [], version: null };
+}
+
+export function createTopicListPage({ namespace = DEFAULT_NAMESPACE } = {}) {
+  const NS = namespace;
+  const { ContentManifest } = cds.entities(NS);
+  async function getActiveVersion(db) {
+    const row = await db.run(SELECT.one.from(ContentManifest).columns('version').where({ status: 'ACTIVE' })).catch(() => null);
+    return row?.version ?? null;
+  }
+  const shellLoader = createShellLoader({
+    namespace: NS, hanaTableName: HANA_TABLE, hanaCurrentTableName: HANA_CURRENT_TABLE,
+    getActiveVersion: () => cds.connect.to('db').then(getActiveVersion),
+  });
+  let cache = null; // { version, gz, etag }
+
+  async function topicsIndexHandler(req, res) {
+    try {
+      const db = await cds.connect.to('db');
+      const version = await getActiveVersion(db);
+      if (cache && cache.version === version) {
+        if (req.headers['if-none-match'] === cache.etag) { res.status(304).end(); return; }
+        setContentCacheHeaders(res, { slug: 'topics' });
+        res.set('Content-Encoding', 'gzip').set('ETag', cache.etag).set('X-Content-Source', 'db-current').type('html').send(cache.gz);
+        return;
+      }
+      const model = await buildTopicListModel(db);
+      model.version = version;
+      const body = renderTopicListBody(model);
+      const meta = { kind: 'topics-index', slug: 'topics', title: 'Explore topics', description: 'Browse SAP developer topics by product hierarchy.' };
+      const shell = await shellLoader.get();
+      if (!shell) throw new ShellMarkerError('shell unavailable');
+      const html = composeShell(shell, body, meta);
+      const gz = gzipSync(Buffer.from(html, 'utf8'));
+      const etag = `"${createHash('sha256').update(gz).digest('hex').slice(0, 32)}"`;
+      cache = { version, gz, etag };
+      if (req.headers['if-none-match'] === etag) { res.status(304).end(); return; }
+      setContentCacheHeaders(res, { slug: 'topics' });
+      res.set('Content-Encoding', 'gzip').set('ETag', etag).set('X-Content-Source', 'db-current').type('html').send(gz);
+    } catch (err) {
+      if (cache) {
+        res.set('Content-Encoding', 'gzip').set('X-Content-Source', 'db-stale').type('html').send(cache.gz);
+        return;
+      }
+      res.status(503).type('text/plain').send('topics index unavailable');
+    }
+  }
+  return { topicsIndexHandler, _invalidate() { cache = null; shellLoader.invalidate?.(); } };
+}
+
+export const { topicsIndexHandler } = createTopicListPage();
+export default topicsIndexHandler;
+```
+
+> **NOTE for implementer:** the cache/etag/shell-loader boilerplate above is transcribed from `concept-list-page.js:239-334`. **Diff your version against that source** and adopt any details you missed (exact `setContentCacheHeaders` args, `getActiveVersion` source table, `ContentManifest` query shape). Do NOT invent behavior the concepts handler doesn't have.
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/unit/topic-list-page.test.js --project unit`
+Expected: PASS (2 cases).
+
+- [ ] **Step 5: Add chrome-shell cases + verify concepts untouched**
+
+Edit `srv/lib/chrome-shell.js`: in `canonicalUrlFor` (kind switch ~`:75-89`) add `case 'topics-index': return '/topics/';` and `case 'topic': return \`/topics/${meta.slug}/\`;`. Add the identical two cases to `buildBreadcrumbJsonLd` (~`:99-137`).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add srv/lib/topic-list-page.js srv/lib/chrome-shell.js test/unit/topic-list-page.test.js
+git commit -m "feat(topics): CAP-rendered tree index (topic-list-page) + chrome-shell topic canonical/breadcrumb"
+```
+
+---
+
+## Task 5: CAP detail renderer (`srv/lib/topic-detail-render.js`)
+
+**Files:**
+- Create: `srv/lib/topic-detail-render.js`
+- Test: extend `test/unit/topics-query.test.js` (add a render block) or new `test/unit/topic-detail-render.test.js`.
+
+**Interfaces:**
+- Consumes: topic detail payload shape from Task 2.
+- Produces: `renderTopicDetail(topic): { body: string, contentHash: string }` — `body` supplies its own `<main>` (the shell has only the marker). `topic` = `{ slug, label, facet, tutorials, concepts, relatedTags }`.
+
+**Reference to mirror:** `srv/lib/concept-detail-render.js:51` (`renderConceptDetail` → `{body, contentHash}`, `body = \`<main>${…}</main>\``, `contentHash = sha256(body)`, throws if key fields missing).
+
+- [ ] **Step 1: Write the failing test**
+
+```js
+// test/unit/topic-detail-render.test.js
+import { describe, it, expect } from 'vitest';
+import { renderTopicDetail } from '../../srv/lib/topic-detail-render.js';
+
+describe('renderTopicDetail', () => {
+  const topic = {
+    slug: 'sap-hana-cloud', label: 'SAP HANA Cloud', facet: 'software-product',
+    tutorials: [{ slug: 'hana-intro', title: 'HANA Intro', level: 'Beginner', time: 15, href: '/tutorials/hana-intro/', isNew: true }],
+    concepts: [{ slug: 'in-memory-database', name: 'In-Memory Database', rank: 0.9 }],
+    relatedTags: [{ slug: 'sap-hana-cloud-data-lake', label: 'Data Lake' }],
+  };
+  it('renders a <main> body with breadcrumb, tutorials, concepts, related tags', () => {
+    const { body, contentHash } = renderTopicDetail(topic);
+    expect(body.startsWith('<main>')).toBe(true);
+    expect(body.endsWith('</main>')).toBe(true);
+    expect(body).toContain('SAP HANA Cloud');
+    expect(body).toContain('href="/tutorials/hana-intro/"');
+    expect(body).toContain('href="/concepts/in-memory-database/"');
+    expect(body).toContain('href="/topics/sap-hana-cloud-data-lake/"');
+    expect(contentHash).toMatch(/^[a-f0-9]{64}$/);
+  });
+  it('throws when slug or label missing', () => {
+    expect(() => renderTopicDetail({ slug: '', label: 'x' })).toThrow();
+  });
+});
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/unit/topic-detail-render.test.js --project unit`
+Expected: FAIL — module not found.
+
+- [ ] **Step 3: Write minimal implementation**
+
+```js
+// srv/lib/topic-detail-render.js
+import { createHash } from 'node:crypto';
+
+function esc(s) {
+  return String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+
+export function renderTopicDetail(topic) {
+  if (!topic?.slug || !topic?.label) throw new Error('renderTopicDetail: slug and label required');
+  const tutorials = (topic.tutorials || []).map(t => `
+      <li class="topic-tutorials__item">
+        <a class="topic-tutorials__link" href="${esc(t.href)}">${esc(t.title)}</a>
+        ${t.isNew ? '<span class="topic-tutorials__new">NEW</span>' : ''}
+        ${t.level ? `<span class="topic-tutorials__level">${esc(t.level)}</span>` : ''}
+      </li>`).join('');
+  const concepts = (topic.concepts || []).map(c => `
+      <li class="topic-concepts__item"><a href="/concepts/${esc(c.slug)}/">${esc(c.name)}</a></li>`).join('');
+  const related = (topic.relatedTags || []).map(r => `
+      <li class="topic-related__item"><a href="/topics/${esc(r.slug)}/">${esc(r.label)}</a></li>`).join('');
+
+  const conceptsSection = concepts
+    ? `<section class="topic-concepts" aria-labelledby="topic-concepts-h">
+        <h2 id="topic-concepts-h">Concepts in this topic</h2>
+        <ul class="topic-concepts__list" role="list">${concepts}</ul>
+      </section>`
+    : '';
+  const relatedSection = related
+    ? `<section class="topic-related" aria-labelledby="topic-related-h">
+        <h2 id="topic-related-h">Related topics</h2>
+        <ul class="topic-related__list" role="list">${related}</ul>
+      </section>`
+    : '';
+
+  const body = `<main>
+  <article class="topic-detail">
+    <nav class="topic-breadcrumb" aria-label="Breadcrumb">
+      <ol class="topic-breadcrumb__list">
+        <li><a href="/">Home</a></li>
+        <li><a href="/topics/">Topics</a></li>
+        <li aria-current="page">${esc(topic.label)}</li>
+      </ol>
+    </nav>
+    <header class="topic-detail__header">
+      <h1 class="topic-detail__title">${esc(topic.label)}</h1>
+      <p class="topic-detail__facet">${esc(topic.facet)}</p>
+    </header>
+    <section class="topic-tutorials" aria-labelledby="topic-tutorials-h">
+      <h2 id="topic-tutorials-h">Tutorials</h2>
+      <ul class="topic-tutorials__list" role="list">${tutorials || '<li>No tutorials yet.</li>'}</ul>
+    </section>
+    ${conceptsSection}
+    ${relatedSection}
+  </article>
+</main>`;
+  const contentHash = createHash('sha256').update(body).digest('hex');
+  return { body, contentHash };
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/unit/topic-detail-render.test.js --project unit`
+Expected: PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add srv/lib/topic-detail-render.js test/unit/topic-detail-render.test.js
+git commit -m "feat(topics): topic detail body renderer"
+```
+
+---
+
+## Task 6: Blob publisher (`srv/lib/publish-topics.js`)
+
+**Files:**
+- Create: `srv/lib/publish-topics.js`
+
+**Interfaces:**
+- Consumes: `loadLiveTags`, `buildTopicDetailPayload` (Task 2); `renderTopicDetail` (Task 5); `composeShell` (chrome-shell).
+- Produces: `renderTopicsIntoSession({ db, sessionId, helpers, priorHashes = {}, shell, deps = {} }): Promise<{ topicsSeen, topicsChanged, topicsSkipped, topicsErrored, durationMs }>`. Key = `topic-${slug}`. Meta = `{ kind: 'topic', slug, title: label, description }`.
+
+**Reference to mirror:** `srv/lib/publish-concepts.js:78-171` — per-item loop, `composeShell` wrap, `sha256(fullDoc)`, delta-skip on `priorHashes[key] === contentHash`, `gzipSync(fullDoc).toString('base64')`, `MAX_ERROR_RATE = 0.05` abort, `BATCH_SIZE = 20` append via `helpers.appendToSession`, `loadPriorTopicHashes` filtering `slug.startsWith('topic-')`.
+
+- [ ] **Step 1: Write the implementation**
+
+```js
+// srv/lib/publish-topics.js
+import { gzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+import { loadLiveTags, buildTopicDetailPayload } from './topics-query.js';
+import { renderTopicDetail } from './topic-detail-render.js';
+import { composeShell } from './chrome-shell.js';
+
+const BATCH_SIZE = 20;
+const MAX_ERROR_RATE = 0.05;
+const META_DESC_MAX = 160;
+
+function topicMetaDescription(topic) {
+  const n = topic.tutorials?.length ?? 0;
+  const c = topic.concepts?.length ?? 0;
+  return `${topic.label}: ${n} tutorials and ${c} concepts on developers.sap.com.`.slice(0, META_DESC_MAX);
+}
+
+export async function renderTopicsIntoSession({ db, sessionId, helpers, priorHashes = {}, shell, deps = {} }) {
+  const start = Date.now();
+  const live = deps.loadLiveTags ? await deps.loadLiveTags(db) : await loadLiveTags(db);
+  let seen = 0, changed = 0, skipped = 0, errored = 0;
+  let batch = [];
+  const flush = async () => {
+    if (!batch.length) return;
+    await helpers.appendToSession({ sessionId, files: Object.fromEntries(batch) });
+    batch = [];
+  };
+  for (const tag of live) {
+    seen++;
+    try {
+      const topic = await buildTopicDetailPayload(db, tag.slug);
+      if (topic.notFound || topic.error) { errored++; continue; }
+      const { body } = renderTopicDetail(topic);
+      const meta = { kind: 'topic', slug: topic.slug, title: topic.label, description: topicMetaDescription(topic) };
+      const fullDoc = composeShell(shell, body, meta);
+      const key = `topic-${topic.slug}`;
+      const contentHash = createHash('sha256').update(fullDoc).digest('hex');
+      if (priorHashes[key] === contentHash) { skipped++; continue; }
+      batch.push([key, gzipSync(Buffer.from(fullDoc, 'utf8')).toString('base64')]);
+      changed++;
+      if (batch.length >= BATCH_SIZE) await flush();
+    } catch {
+      errored++;
+      if (seen > 20 && errored / seen > MAX_ERROR_RATE) throw new Error('renderTopicsIntoSession: error rate exceeded');
+    }
+  }
+  await flush();
+  return { topicsSeen: seen, topicsChanged: changed, topicsSkipped: skipped, topicsErrored: errored, durationMs: Date.now() - start };
+}
+```
+
+> **NOTE for implementer:** wiring `renderTopicsIntoSession` into the actual publish orchestration (the POST `/content/publish/render-*` chain and `loadPriorConceptHashes` equivalent) mirrors `publish-concepts.js:159-194`. Locate where `renderConceptsIntoSession` is invoked during a publish run and register a sibling `renderTopicsIntoSession` call in the same place, loading prior hashes filtered by `slug.startsWith('topic-')`. Confirm the `shell`/`helpers`/`sessionId` objects passed to concepts are reused verbatim.
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add srv/lib/publish-topics.js
+git commit -m "feat(topics): per-slug HANA blob publisher (renderTopicsIntoSession)"
+```
+
+---
+
+## Task 7: Dynamic-slug discovery in publish (`page-key-map.js` + `publish-content.ts`)
+
+**Files:**
+- Modify: `srv/lib/page-key-map.js` (add `TOPIC_KEY_PREFIX`, `isTopicKey`, `discoverTopicPages`)
+- Modify: `scripts/publish-content.ts:~1058-1071` (call site)
+- Test: extend `test/unit` page-key-map coverage if present; else add `test/unit/page-key-map-topics.test.js`.
+
+**Interfaces:**
+- Produces: `TOPIC_KEY_PREFIX = 'topic-'`; `isTopicKey(key): boolean`; `discoverTopicPages(hugoDir): Map<string, string>`.
+
+> **DESIGN NOTE:** topic detail blobs are produced server-side by `renderTopicsIntoSession` (Task 6), NOT from Hugo files on disk — there is no `hugo/.../topic-<slug>/index.html`. So `discoverTopicPages` is only relevant if topics are published as file-backed blobs. Since topics are **server-rendered at publish time**, the canonical publish path is the `renderTopicsIntoSession` server call (Task 6), invoked in the publish orchestration alongside `renderConceptsIntoSession`. **Confirm which mechanism the concepts subsystem actually uses at publish time** (recon shows concepts use the *server-side* `renderConceptsIntoSession`, not `discoverPageFiles`). If concepts are server-rendered, SKIP the `discoverTopicPages` file-walker entirely and rely solely on Task 6's server call — this task then reduces to registering that call.
+
+- [ ] **Step 1: Determine the actual publish mechanism**
+
+Read `scripts/publish-content.ts` around the concepts publish step and `srv/lib/publish-concepts.js:159-194`. Decide:
+- **(A) Server-rendered** (expected): concepts blobs are generated by a POST to `/content/publish/render-concepts`. → Register a sibling topics render call; **do not** add `discoverTopicPages`. Skip Steps 2-4 below.
+- **(B) File-backed**: concepts index/detail come from disk via `discoverPageFiles`. → Add `discoverTopicPages` (Steps 2-4).
+
+- [ ] **Step 2 (only if B): Add discovery helper**
+
+```js
+// srv/lib/page-key-map.js — near AUTHOR/ADVOCATE prefixes
+export const TOPIC_KEY_PREFIX = 'topic-';
+export const isTopicKey = (key) => key.startsWith(TOPIC_KEY_PREFIX);
+
+export function discoverTopicPages(hugoDir) {
+  const out = new Map();
+  const base = path.join(hugoDir, 'topics');
+  let entries = [];
+  try { entries = fs.readdirSync(base, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    const slug = e.name;
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) continue;
+    const idx = path.join(base, slug, 'index.html');
+    if (fs.existsSync(idx)) out.set(`${TOPIC_KEY_PREFIX}${slug}`, idx);
+  }
+  return out;
+}
+```
+
+- [ ] **Step 3 (only if B): Wire the call site** in `scripts/publish-content.ts` next to the author/advocate discovery block:
+
+```ts
+const topics = discoverTopicPages(opts.hugoDir);
+for (const [key, absPath] of topics) tutorials.set(key, absPath);
+```
+
+- [ ] **Step 4 (only if B): Test + commit.**
+
+- [ ] **Step 5 (path A): Register the server render call**
+
+Add the `renderTopicsIntoSession` invocation to the publish orchestration alongside the concepts call (mirror `publish-concepts.js`'s `createRenderConcepts`/handler registration; expose `POST /content/publish/render-topics` in `srv/server.js` if concepts has an analogous route). Load prior hashes filtering `slug.startsWith('topic-')`.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add srv/lib/page-key-map.js scripts/publish-content.ts srv/server.js
+git commit -m "feat(topics): register topic-blob publish step in content publish path"
+```
+
+---
+
+## Task 8: Register CAP routes (`srv/server.js`)
+
+**Files:**
+- Modify: `srv/server.js`
+
+**Interfaces:**
+- Consumes: `buildTopicsTreeHandler`, `buildTopicDetailHandler` (Task 3); `topicsIndexHandler`, `createTopicListPage` (Task 4); `buildTopicDetailPayload`, `resolveTopicBySlug` (Task 2); `renderTopicDetail` (Task 5); shell loader + serve helpers already used by `/content/concepts/:slug`.
+
+**Reference to mirror:** imports `server.js:15-37`; `/build/*` registrations `:296-306`; `/content/concepts/:slug` wrapper `:503-528`; `/content/concepts-index` `:533`.
+
+- [ ] **Step 1: Add imports** (top of `srv/server.js`, with sibling imports)
+
+```js
+import { buildTopicsTreeHandler, buildTopicDetailHandler } from './lib/build-topics.js';
+import { topicsIndexHandler } from './lib/topic-list-page.js';
+import { resolveTopicBySlug, buildTopicDetailPayload } from './lib/topics-query.js';
+import { renderTopicDetail } from './lib/topic-detail-render.js';
+```
+
+- [ ] **Step 2: Register build feeds** (next to `:298-300`)
+
+```js
+app.get('/build/topics-tree', buildTopicsTreeHandler);
+app.get('/build/topics/:slug', buildTopicDetailHandler);
+```
+
+- [ ] **Step 3: Register content index** (next to `:533`)
+
+```js
+app.get('/content/topics-index', topicsIndexHandler);
+```
+
+- [ ] **Step 4: Register content detail** — serves the published `topic-<slug>` blob, with legacy/retired redirect fallthrough. Mirror the `/content/concepts/:slug` wrapper (`:503-528`) that rewrites `req.params.slug = \`concept-${lower}\`` then delegates to `serveHandler`. For topics, resolve legacy/retired slugs to a 301 before the blob lookup:
+
+```js
+app.get('/content/topics/:slug', async (req, res, next) => {
+  let raw = String(req.params.slug || '').replace(/\.html$/, '');
+  const lower = raw.toLowerCase();
+  if (raw !== lower) { res.redirect(301, `/topics/${lower}/`); return; }
+  // legacy -N / retired resolution
+  try {
+    const db = await cds.connect.to('db');
+    const { tag, redirectTo } = await resolveTopicBySlug(db, lower);
+    if (!tag && redirectTo) { res.redirect(301, redirectTo); return; }
+    if (tag && redirectTo) { res.redirect(301, redirectTo); return; }
+  } catch { /* fail-open to blob lookup */ }
+  // delegate to the shared blob serve handler with topic- key prefix (same as concepts)
+  req.params.slug = `topic-${lower}`;
+  return serveHandler(req, res, next);
+});
+```
+
+> **NOTE for implementer:** `serveHandler` is the same content-store serve function `/content/concepts/:slug` delegates to (`server.js:526-527`). Confirm its exact name/signature at that line and match it. If a served `topic-<slug>` blob is missing (never published), `serveHandler` will 404 — acceptable; the resolve step above catches *known-live-but-unpublished* only insofar as it doesn't redirect them. For a fully fail-open detail path, when `serveHandler` would 404 AND the slug resolves to a live tag, fall back to on-the-fly render:
+> ```js
+> // optional fallback inside a wrapper around serveHandler's 404
+> const payload = await buildTopicDetailPayload(db, lower);
+> if (!payload.notFound) { /* renderTopicDetail + composeShell + send */ }
+> ```
+> Decide based on whether concepts has an equivalent live-render fallback; prefer parity.
+
+- [ ] **Step 5: Verify build feeds live**
+
+```bash
+cds watch &   # or npm run dev:hybrid for real HANA
+sleep 8
+curl -s http://localhost:4004/build/topics-tree | jq '.tree | length, .error'
+curl -s http://localhost:4004/build/topics/sap-hana-cloud | jq '{tutorials: (.tutorials|length), concepts: (.concepts|length), error}'
+```
+Expected: tree length ≥ 1, `error: null`; detail returns tutorials/concepts arrays (may be empty in a bare in-memory DB — verify against seeded/hybrid data).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add srv/server.js
+git commit -m "feat(topics): register /build/topics-tree, /build/topics/:slug, /content/topics-index, /content/topics/:slug"
+```
+
+---
+
+## Task 9: Approuter routes + search redirect (`approuter/xs-app.json`)
+
+**Files:**
+- Modify: `approuter/xs-app.json`
+
+**Reference:** concepts index route `:546-550`, detail route `:552-556`, `/build/*` allow-list `:399`, current `/topics/` route `:585`, `/search/` OData route `:375-376`, catch-all `:605`.
+
+- [ ] **Step 1: Add `topics-tree` to the `/build/*` allow-list alternation** (`:399`) — insert `|topics-tree` into the group (keep `topics-gallery` until Task 11 retires it, or replace it):
+
+```json
+{ "source": "^/build/(breadcrumb-context|catalog|co-completions|concepts|homepage-shelves|kg-stats|mission|my-progress|navigator|repo-catalog|slug-mapping|tag-labels|topics-gallery|topics-tree|topics)(/.*)?(\\?.*)?$", "target": "/build/$1$2$3", "destination": "srv-api", "authenticationType": "none" }
+```
+
+> `topics` (bare) covers `/build/topics/:slug`; `topics-tree` covers the index feed. Ensure `topics` does not shadow `topics-tree` — regex alternation is ordered but both are matched as whole path segments by the `(/.*)?` boundary, so list `topics-tree` before `topics`.
+
+- [ ] **Step 2: Replace the `page-topics` index route** (`:585`) with the dynamic index route, and add the detail route immediately after. Both MUST precede the catch-all `^(.*)$` (`:605`):
+
+```json
+{ "source": "^/topics/?(\\?.*)?$", "target": "/content/topics-index$1", "destination": "srv-api", "authenticationType": "none" },
+{ "source": "^/topics/(.*)$", "target": "/content/topics/$1", "destination": "srv-api", "authenticationType": "none" }
+```
+
+- [ ] **Step 3: Add the `/search/` → `/tutorial-navigator/` redirect, scoped to bare `/search/` + query only** so it does NOT shadow the OData `SearchService` routes (`^/search/(.*)$` at `:375-376`). Place this redirect BEFORE the OData `/search/` route:
+
+```json
+{ "source": "^/search/?(\\?.*)?$", "target": "/tutorial-navigator/$1", "status": 301, "authenticationType": "none" }
+```
+
+> Verify `/search/SearchableItems` etc. still route to `srv-api` (the `^/search/(.*)$` route must remain and must be reached for non-empty paths). Test both after deploy.
+
+- [ ] **Step 4: Validate JSON**
+
+Run: `jq . approuter/xs-app.json > /dev/null && echo OK`
+Expected: `OK` (no parse error).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add approuter/xs-app.json
+git commit -m "feat(topics): approuter dynamic /topics routes + /search 301 to navigator"
+```
+
+---
+
+## Task 10: Progressive-enhancement island (`hugo-apps/src/topics-tree/`)
+
+**Files:**
+- Create: `hugo-apps/src/topics-tree/main.ts`, `hugo-apps/src/topics-tree/App.vue`
+- Modify: `hugo-apps/vite.config.ts:~316` (add entry)
+
+**Interfaces:**
+- Consumes: server-embedded `<script type="application/json" id="topics-tree-data">` (Task 4) and mount root `#topics-tree-root`.
+- Produces: island bundle `topics-tree` in the Vite manifest → picked up by `scripts/build-island-manifest.cjs` → `islandSrc('topics-tree')`.
+
+- [ ] **Step 1: Register the entry** in `hugo-apps/vite.config.ts` `rollupOptions.input` (next to `'concepts-filter'` `:316`):
+
+```ts
+'topics-tree': resolve(__dirname, 'src/topics-tree/main.ts'),
+```
+
+- [ ] **Step 2: Write the island**
+
+```ts
+// hugo-apps/src/topics-tree/main.ts
+// Progressive enhancement over the server-rendered tree. Adds a type-ahead
+// filter + expand/collapse-all. Inert until JS loads; the server markup is
+// fully functional without it.
+function boot() {
+  const root = document.getElementById('topics-tree-root');
+  const input = document.getElementById('topics-filter-input') as HTMLInputElement | null;
+  if (!root || !input) return;
+
+  const items = Array.from(root.querySelectorAll('li'));
+  const details = Array.from(root.querySelectorAll('details')) as HTMLDetailsElement[];
+
+  input.addEventListener('input', () => {
+    const q = input.value.trim().toLowerCase();
+    if (!q) {
+      items.forEach((li) => (li.style.display = ''));
+      return;
+    }
+    // Show any li whose text matches; open ancestor details.
+    items.forEach((li) => {
+      const match = (li.textContent || '').toLowerCase().includes(q);
+      li.style.display = match ? '' : 'none';
+    });
+    // Reveal matches by opening every details that contains a visible match.
+    details.forEach((d) => {
+      const hasVisible = Array.from(d.querySelectorAll('li')).some((li) => (li as HTMLElement).style.display !== 'none');
+      d.open = hasVisible;
+      (d.closest('li') as HTMLElement | null && ((d.closest('li') as HTMLElement).style.display = hasVisible ? '' : 'none'));
+    });
+  });
+
+  // Deep-link: open the node whose slug is in the hash (#topic=<slug>).
+  const m = location.hash.match(/topic=([a-z0-9-]+)/);
+  if (m) {
+    const link = root.querySelector(`a[href="/topics/${m[1]}/"]`);
+    let el = link?.closest('details') as HTMLDetailsElement | null;
+    while (el) { el.open = true; el = el.parentElement?.closest('details') as HTMLDetailsElement | null; }
+    link?.scrollIntoView({ block: 'center' });
+  }
+}
+
+if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', boot);
+else boot();
+```
+
+> **NOTE:** this island is plain TS DOM enhancement (no Vue component tree needed — the tree HTML is server-rendered). An `App.vue` is unnecessary; delete it from the file list if you keep this approach. If you prefer a Vue mount for future features, mirror `concepts-filter`'s `createApp(...).mount(...)` pattern instead. Keep it inert-until-loaded either way.
+
+- [ ] **Step 3: Build + verify the island lands in the manifest**
+
+```bash
+cd hugo-apps && npx vite build
+cd .. && node scripts/build-island-manifest.cjs
+jq '."topics-tree"' hugo/data/island_manifest.json
+```
+Expected: a `/js/topics-tree-<hash>.js` path (non-null).
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add hugo-apps/src/topics-tree hugo-apps/vite.config.ts
+git commit -m "feat(topics): topics-tree progressive-enhancement island (filter + deep-link)"
+```
+
+---
+
+## Task 11: Retire legacy topics + search-form interim fix
+
+**Files:**
+- Modify (interim, then delete): `hugo/layouts/topics/list.html`
+- Delete: `hugo/content/topics/btp-basics.md`, `hugo/content/topics/cap-fundamentals.md`, `hugo/layouts/topics/list.html`, `hugo/layouts/topics/single.html`, `hugo/data/topics_gallery.json`, `scripts/fetch-topics-gallery.ts`
+- Sweep: orphaned tests referencing `topics_gallery` / `build-topics-gallery` / `fetch-topics-gallery` / the deleted layouts.
+
+> **KEEP:** `srv/lib/build-topics-gallery.js` + `/build/topics-gallery` + `hugo/data/topic_clusters.json` + `hugo/data/featured_topics.json` are the **homepage** band — untouched. Only the `/topics/` section is retired. Confirm no homepage code imports the deleted files.
+
+- [ ] **Step 1: Grep for consumers of what you're deleting**
+
+```bash
+grep -rn "topics_gallery\|fetch-topics-gallery\|layouts/topics\|topics/single\|topics/list" \
+  --include=*.js --include=*.ts --include=*.cjs --include=*.html --include=*.json \
+  scripts srv test hugo package.json | grep -v node_modules
+```
+Record every hit; each must be updated or deleted in this same commit.
+
+- [ ] **Step 2: Remove the `fetch-topics-gallery` build wiring** — check `package.json` scripts and `scripts/fetch-tutorials.ts` / `build:*` chains for a `fetch-topics-gallery` invocation; remove it. Confirm nothing else calls it.
+
+- [ ] **Step 3: Delete the files**
+
+```bash
+git rm hugo/content/topics/btp-basics.md hugo/content/topics/cap-fundamentals.md \
+       hugo/layouts/topics/list.html hugo/layouts/topics/single.html \
+       hugo/data/topics_gallery.json scripts/fetch-topics-gallery.ts
+```
+
+- [ ] **Step 4: Delete/adjust orphaned tests** found in Step 1 (per the deleting-source-file rule — sweep in the same commit).
+
+- [ ] **Step 5: Verify build still green**
+
+```bash
+npm run fetch-tutorials && npm run build:all 2>&1 | tail -30
+```
+Expected: no reference-to-deleted-file errors; Hugo build completes. `/topics/` no longer produced by Hugo (now CAP-served).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add -A
+git commit -m "chore(topics): retire legacy topics_gallery section (homepage band untouched)"
+```
+
+---
+
+## Task 12: srv-qa cp-list audit (`.deploy/mta.yaml`)
+
+**Files:**
+- Modify: `.deploy/mta.yaml` (`srv-qa` module `cp` list)
+
+- [ ] **Step 1: Walk transitive `./` imports from `content-store.js`** and confirm reachability of the new modules. `publish-topics.js` is reached from the publish path; if `content-store.js` (or anything it imports) now transitively imports any of `topics-query.js`, `topic-slug.js`, `topic-detail-render.js`, `publish-topics.js`, `topic-list-page.js`, `build-topics.js`, they must all appear in the `srv-qa` `cp` list.
+
+```bash
+grep -rn "from './topic\|from './build-topics\|from './publish-topics" srv/lib/content-store.js srv/lib/*.js
+```
+
+- [ ] **Step 2: Add every reachable new `srv/lib/*` file to the `srv-qa` `cp` list** in `.deploy/mta.yaml`, matching the existing concepts entries (`concept-list-page.js`, `published-concepts-query.js`, `chrome-shell.js`, etc.). Also confirm no NEW npm package is introduced that srv-qa's stripped deps lack (this plan adds none — all imports are `node:*` + existing `@sap/cds`).
+
+- [ ] **Step 3: Validate**
+
+```bash
+grep -n "topic" .deploy/mta.yaml
+```
+Expected: each reachable new file listed under `srv-qa`.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add .deploy/mta.yaml
+git commit -m "chore(topics): add topics srv/lib modules to srv-qa cp list"
+```
+
+---
+
+## Task 13: e2e + smoke coverage
+
+**Files:**
+- Create: `test/e2e/topics.spec.ts`
+- Extend: existing smoke suite (add `/topics/` + a `/topics/<slug>/` route assertion).
+- Create/extend: `test/hybrid/topics-publish-serve.test.js`.
+
+**Interfaces:** consumes deployed endpoints; self-skips without `SMOKE_BASE_URL` (e2e convention).
+
+- [ ] **Step 1: e2e spec (post-deploy, self-skipping)**
+
+```ts
+// test/e2e/topics.spec.ts
+import { test, expect } from '@playwright/test';
+
+const BASE = process.env.SMOKE_BASE_URL;
+test.skip(!BASE, 'SMOKE_BASE_URL not set');
+
+test('topics index renders a tree and search links to navigator', async ({ page }) => {
+  await page.goto(`${BASE}/topics/`);
+  await expect(page.locator('#topics-tree-root')).toBeVisible();
+  await expect(page.locator('details summary').first()).toBeVisible();
+  await expect(page.locator('a[href="/tutorial-navigator/"]').first()).toBeVisible();
+});
+
+test('a topic leaf navigates to a detail page with tutorials', async ({ page }) => {
+  await page.goto(`${BASE}/topics/`);
+  const firstTopic = page.locator('#topics-tree-root a[href^="/topics/"]').first();
+  await firstTopic.click();
+  await expect(page).toHaveURL(/\/topics\/[a-z0-9-]+\//);
+  await expect(page.locator('h1')).toBeVisible();
+  await expect(page.locator('.topic-tutorials, main')).toBeVisible();
+});
+
+test('/search/?q= redirects to the navigator', async ({ page }) => {
+  await page.goto(`${BASE}/search/?q=cap`);
+  await expect(page).toHaveURL(/\/tutorial-navigator\//);
+});
+```
+
+- [ ] **Step 2: Hybrid round-trip** (`--project hybrid`, real HANA via `cds bind --exec`)
+
+```js
+// test/hybrid/topics-publish-serve.test.js
+import { describe, it, expect } from 'vitest';
+// Assert /build/topics-tree and /build/topics/:slug are non-empty against real
+// tag + KG data; publish→serve round-trip for a sample topic blob; slug lowercased.
+// Mirror the structure of test/hybrid/page-publish-serve.test.js.
+```
+
+Fill this in mirroring `test/hybrid/page-publish-serve.test.js` (publish a `topic-<slug>` blob, GET `/content/topics/<slug>`, assert 200 + `X-Content-Source`).
+
+- [ ] **Step 3: Smoke** — add to the existing smoke suite: `GET /topics/` → 200 with `x-content-source`; `GET /topics/<known-live-slug>/` → 200. Use a slug guaranteed live (derive from `/build/topics-tree` at test time rather than hardcoding).
+
+- [ ] **Step 4: Run what's runnable locally**
+
+```bash
+npx vitest run test/unit --project unit
+# hybrid requires cf login + cds bind:
+npm run test:hybrid -- topics-publish-serve 2>&1 | tail -20
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add test/e2e/topics.spec.ts test/hybrid/topics-publish-serve.test.js
+git commit -m "test(topics): e2e + hybrid + smoke coverage for tag-tree topics"
+```
+
+---
+
+## Task 14: Full-suite gate + PR
+
+- [ ] **Step 1: Run the unit suite**
+
+```bash
+npm test 2>&1 | tail -30
+```
+Expected: green (fix any regressions from Task 11 deletions before proceeding).
+
+- [ ] **Step 2: Confirm branch base + push**
+
+```bash
+git fetch origin
+git log --oneline origin/DEV -1        # confirm base
+git push -u origin worktree-tag-tree-topics
+```
+
+- [ ] **Step 3: Open a DRAFT PR targeting DEV**
+
+```bash
+gh pr create --base DEV --draft \
+  --title "feat(topics): tag-tree topics — CAP-served index + detail, concept enrichment, search fix" \
+  --body "Implements docs/superpowers/specs/2026-09-01-tag-tree-topics-design.md. Rebuilds /topics/ to concept-parity: stable SAP-tag slugs, CAP tree index + per-slug HANA-blob detail, deterministic concept enrichment via TutorialConceptLinks, /search/ → navigator redirect. Legacy topics_gallery section retired (homepage band untouched). Deploy: full MTA (approuter route + srv/lib changes); topic blobs publish via gh workflow rebuild-content.yml."
+```
+
+- [ ] **Step 4: Report to Tom** — PR URL, deploy scope (full MTA: approuter + srv/lib), and that topic-blob content publish runs via `gh workflow run rebuild-content.yml` post-deploy.
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- §1 defect 1 (404s) → Tasks 8, 9 (dynamic `/topics/(.*)` route + CAP detail handler). ✓
+- §1 defect 2 (empty concepts) → Task 2 `buildTopicDetailPayload` concept-enrichment via `TutorialConceptLinks` replacing the `KgCommunity` join. ✓
+- §1 defect 3 (search) → Tasks 9, 11 (approuter 301 + form repoint). ✓
+- §1 link-rot (LLM Louvain slugs) → Task 1 stable tag-hierarchy slugs. ✓
+- §3 slug scheme + collision → Task 1 (`buildTopicSlugMap`, tested). ✓
+- §4.1 `/build/topics-tree` → Tasks 2, 3, 8. ✓
+- §4.2 `/build/topics/:slug` → Tasks 2, 3, 8. ✓
+- §4.3 retire gallery from `/topics/` (keep homepage) → Task 11. ✓
+- §5 CAP-rendered tree index + island → Tasks 4, 10. ✓
+- §5.1 CAP detail renderer → Tasks 5, 6, 8. ✓
+- §6 serve/publish backbone → Tasks 6, 7, 8, 9, 12. ✓
+- §6.1 legacy `-N` / retired 301 → Tasks 2 (`resolveTopicBySlug`), 8. ✓
+- §7 search fix → Tasks 9, 11. ✓
+- §8 testing (unit/hybrid/e2e/smoke) → Tasks 1-5 unit, 13 hybrid/e2e/smoke. ✓
+- §9 rollout (branch off DEV, fail-open) → Global Constraints + Task 14; fail-open in Tasks 2, 4. ✓
+
+**Placeholder scan:** Code steps carry real code. Two deliberate implementer-decision notes (Task 7 path A/B, Task 8 serveHandler name/fallback) are flagged because the exact concepts publish/serve wiring must be read from source at execution time — each names the precise reference lines and the decision rule, not a vague "handle it." Task 2 flags the one unverified column name (`timeToComplete`) with resolution steps.
+
+**Type consistency:** `Tag` shape (Task 1) consumed unchanged in Tasks 2/6. `buildTopicDetailPayload` return shape (Task 2) consumed by `renderTopicDetail` (Task 5: `{slug,label,facet,tutorials,concepts,relatedTags}`) and `renderTopicsIntoSession` (Task 6). Tree node shape (Task 2) consumed by `renderTopicListBody` (Task 4) and the island's embedded JSON (Task 10). `topic-<slug>` key prefix consistent across Tasks 6, 7, 8. Meta `{kind:'topic'|'topics-index'}` consistent across Tasks 4 (chrome-shell cases), 5, 6.
+
+**Open questions from spec** (§10) resolved by design defaults: bare-leaf slug + qualify-on-collision (Task 1); retired → `/topics/` unless legacy `-N` base resolves (Task 2); no left-rail (index-tree + relatedTags only); CAP-only, no Hugo topics data file (Task 11 retires the Hugo section). No task needed for the deferred items.
diff --git a/docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md b/docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md
new file mode 100644
index 000000000..799197bd5
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-31-tutorials-admin-op-enhancements-design.md
@@ -0,0 +1,136 @@
+# Tutorials Admin Object Page — Enhancements Design
+
+**Date:** 2026-08-31
+**Status:** Draft for review
+**Scope:** `AdminService.Tutorials` Object Page (Fiori Elements) + supporting CDS model, fetch/publish pipeline, and object-store exposure.
+
+## Motivation
+
+The Tutorials admin Object Page has three facets that render **empty tables** despite being wired correctly end-to-end, plus a large body of persisted data that is never surfaced. Investigation (four research passes) found a single recurring root cause for the empties: **the admin UI is correctly wired, but the fetch/publish pipeline never populates the backing entity with data it already holds.** This design closes those gaps and adds high-value read-only facets from data we already persist.
+
+Example tutorial used for reference: `Tutorials(ID=1350bd47-09eb-5656-a9b9-bdc2575441cb)` on `developers.sap.com/admin-ui/`.
+
+## Decisions locked (from brainstorming)
+
+1. **Categories** — one-time backfill **plus** self-healing at publish time.
+2. **Validation rules** — **persist** the full parsed `rules.vr` rule set at publish time into a new read-only entity (not on-demand GitHub parse).
+3. **Contributors** — populate the **full git-derived contributor list** (up to 10: login, name, email, avatar), each linking to `github.com/<login>`.
+4. **Media** — surface object-store items with **rich detail** (explicit user ask).
+
+## Resolved decisions (approved 2026-08-31)
+
+- **D1 — Object Store prod binding gap.** `package.json` sets `attachments.kind: s3` for `[production]`, but **`mta.yaml` declares no `objectstore` resource and `tutorials-srv` binds none**. **Resolved:** ship the Media facet (works regardless of backing store); the S3 binding is a **separate ops task**, out of scope here.
+- **D2 — Byte size / image dimensions.** **Resolved:** add `byteSize : Integer64` and persist `buffer.length` at ingest now; **defer** width/height (needs `probe-image-size` wiring).
+- **D3 — WS3 validation UI.** **Resolved:** keep BOTH facets — relabel the existing AI-only facet "AI-Graded Validation", add the new "All Validation Rules" facet alongside it.
+
+## Workstreams
+
+Five independently shippable workstreams. Suggested phasing at the end.
+
+---
+
+### WS1 — Categories: populate + self-heal
+
+**Problem:** The Categories facet reads `TutorialCategories` (AI-classifier-derived junction, cosine ≥ 0.32 / LLM tiebreak). Publish/migration create `Tutorials` rows via **direct `INSERT.into(Tutorials)`** (`srv/lib/content-publish-session.js:748-762`), bypassing the CAP `after('CREATE','Tutorials')` classifier hook (`srv/handlers/categories-after-hooks.js:44-53`). So classification never fires for published tutorials.
+
+**Design:**
+1. **Backfill (one-time):** confirm category seed embeddings exist (admin `embedAllSeeds`), then run `scripts/backfill-categories.cjs` against the target DB.
+2. **Self-heal (pipeline):** after `upsertTutorialMetadata`/`linkTutorialAuthorship` in `content-publish-session.js` (~`:198-210`), iterate the already-collected touched `tutorialIds` and call the exported `classifyAndPersist('tutorial', id).catch(warn)` **fire-and-forget** — mirroring the swallow-and-warn dispatcher in `categories-after-hooks.js:34-40`. Never throw into the publish tx.
+
+**No schema change.** `TutorialCategories`, its projection (`srv/admin-service.cds:174`), `@UI.LineItem`, and the facet already exist.
+
+**Risk:** classification is LLM-backed on the tiebreak path; publishing many slugs could fan out calls. Mitigate by keeping it fire-and-forget and reusing the existing threshold/short-circuit (most slugs resolve on cosine alone; skips write nothing).
+
+**Testing:** unit — publish a tutorial through the session, assert `classifyAndPersist` invoked with the new `tutorial_ID`; hybrid — publish + assert `TutorialCategories` rows exist for the slug.
+
+---
+
+### WS2 — Contributors: map git list + GitHub links
+
+**Problem:** `TutorialContributors` is fully wired (entity `db/schema.cds:451-457`, projection `srv/admin-service.cds:234`, `@UI.LineItem` + facet `app/admin-annotations.cds:715-725,767`) but never populated per-tutorial: IMS migration inserts rows with `tutorial_ID = NULL` (`scripts/migrate-from-hana.js:360`); publish only SELECTs/UPDATEs (`linkTutorialAuthorship`), never INSERTs. The rich git contributor list (`{login, name, email, avatarUrl}`) exists in scope at fetch time (`scripts/fetch-tutorials.ts` ~`:936-948`) and flows to Hugo frontmatter (`render-frontmatter.ts:119`) but never into CAP.
+
+**Design:**
+1. **Schema:** extend `TutorialContributors` with `login : String(255)`, `avatarUrl : String(1024)`, `profileUrl : String(1024)` (derive `profileUrl = https://github.com/<login>`). Keep existing `name`, `email`, `role`, `user`. Add via `cds build --production` migration (never hand-author `.hdbmigrationtable`); register the entity in `db/persistence.cds` if a fresh table/columns need journaling.
+2. **Sidecar (fetch):** beside the validate-answer write (`fetch-tutorials.ts:1043`), write `<slug>.contributors.json` = `{ slug, contributors: contributors.slice(0,10).map(...) }` using the in-scope array (same `writeFileSync(join(CACHE_DIR, ...))` idiom).
+3. **Publish aux step:** mirror `publishValidateAnswerSpecs` — a new client collector in `publish-content.ts` globs `*.contributors.json` and POSTs `{ slug, contributors }` per slug (non-fatal aux step).
+4. **Server upsert:** new `srv/lib/contributors-publish.js` following the **REPLACE-per-slug inside `cds.tx()`** pattern from `validate-answer-spec-publish.js`: resolve tutorial by lowercased slug → `DELETE.from(TutorialContributors).where({tutorial_ID})` → `INSERT` the new set. Apply the `entity_not_in_model` fail-fast guard and skip on `channel === 'qa'` if the QA namespace lacks the entity.
+5. **UI:** add `login` (as GitHub link via `@Communication.Contact` or a `@UI.LineItem` cell with `@Common.SemanticObject`/URL), `avatarUrl`, and keep name/email/role. Render the avatar + external link to `github.com/<login>`, mirroring the live page (`tutorial-author.html`).
+
+**srv-qa cp-list:** add `srv/lib/contributors-publish.js` to the `cp` command in `.deploy/mta.yaml` (module `tutorials-srv-qa`, ~`:175`).
+
+**Testing:** unit — server upsert replaces rows for a slug, leaves other slugs untouched; parser — sidecar shape; hybrid — publish + assert contributor rows with `login`/`avatarUrl` link to the tutorial.
+
+---
+
+### WS3 — Validation: surface ALL rules.vr rules
+
+**Problem:** The Validation Questions facet is bound to `ValidateAnswerSpecs`, which by design persists **only AI-graded** questions (`collectAiGradedSpecs` drops non-AI at `scripts/parsers/rules.ts:320`; `correctAnswer` is server-only for AI grading). `rules.vr` *is* fully fetched and parsed for every tutorial, but the plain client-graded MCQ/exact-match rules are never persisted.
+
+**Design:**
+1. **New entity** `TutorialValidationRules` (read-only in admin), key `(tutorial, stepNumber, questionId)`, fields: `questionText`, `ruleType`, `questionType` (MCQ/TEXT), `choiceMode` (single/multiple), `options` (LargeString JSON or child rows), `correctAnswer`, `aiGrading : Boolean`. Register in `db/persistence.cds`.
+   - *Note:* MCQ correct answers for client-graded rules are already public (they ship in Hugo frontmatter `TutorialStep.validation`), so showing them in the admin is not a new leak. AI-graded reference answers remain in `ValidateAnswerSpecs` as today.
+2. **Sidecar (fetch):** write `<slug>.validation-rules.json` = `{ slug, rules: [...] }` from the **full** `validationMap` (available at `fetch-tutorials.ts:975`), not the AI-filtered subset. Carry `type`, `options`, `choiceMode`, `correctAnswers` in addition to the AI-spec fields.
+3. **Publish + server upsert:** same REPLACE-per-slug pattern (new `srv/lib/validation-rules-publish.js`; add to srv-qa cp-list).
+4. **UI:** new facet "All Validation Rules" (read-only `@UI.LineItem`) with columns: step, question, type, ruleType, grading (AI/client), correct answer. **Keep both facets** (D3): relabel the existing AI facet "AI-Graded Validation"; the new all-rules facet sits alongside it.
+
+**Testing:** parser — sidecar carries all rule types incl. non-AI; server upsert REPLACE semantics; hybrid — publish a tutorial with mixed AI + MCQ rules, assert both appear in `TutorialValidationRules` and only AI ones in `ValidateAnswerSpecs`.
+
+---
+
+### WS4 — Knowledge-Graph facet
+
+**Problem:** The richest hidden dataset. `TutorialConceptLinks` (teaches/extends + confidence, `db/knowledge-graph.cds:61-70`), `TutorialRank` (PageRank, `:196-200`), `KgCommunity`/`KgCommunityLabel`, and `CoCompletions` ("users who did A also did B") are **not exposed on AdminService** (they live on `KnowledgeGraphService`).
+
+**Design (read-only, additive):**
+1. Expose on `AdminService` as `@readonly` projections + associations from `Tutorials`:
+   - `conceptLinks` (teaches/prerequisites with confidence) — association already injected on the db entity (`db/knowledge-graph.cds:94-97`).
+   - `TutorialRank` — surface score as a virtual/flattened field or a small FieldGroup.
+   - Community label — via `KgCommunity`/`KgCommunityLabel` (KgCommunityMembers already exposed `srv/admin-service.cds:1249`).
+   - Co-completed neighbors — new read-only projection on `CoCompletions`.
+   - Use `@cds.redirection.target: false` on pick-list-style projections to avoid stealing redirects (pattern at `srv/admin-service.cds:114,120`).
+2. **UI:** a "Knowledge Graph" facet: LineItem of concepts taught (concept, predicate, confidence), a prerequisites list, PageRank + community label in a FieldGroup, and a co-completed-tutorials LineItem.
+
+**No pipeline change** — these are populated by existing nightly jobs. **Fail-open reads** (mirror existing KG decorators that leave fields unset on SELECT throw).
+
+**Testing:** unit — projections resolve and are `@readonly`; hybrid — a tutorial with concept links shows them.
+
+---
+
+### WS5 — Media facet + Freshness report header
+
+**Problem:** `TutorialImages` (`db/tutorial-images.cds`) and `TutorialAssets` (`db/tutorial-assets.cds`) are **not exposed on any service**. `FreshnessReport` is exposed (`srv/admin-service.cds:129`) but the OP only facets findings, not the report header.
+
+**Design — Media:**
+1. **Expose** `@readonly` projections of `TutorialImages` and `TutorialAssets` on `AdminService`, reachable from `Tutorials` (association on matching `slug`, `channel='prod'`). The `content : Composition of many Attachments` child auto-exposes with `@cap-js/attachments` annotations (`@Core.MediaType`, `@Core.ContentDisposition`, `@UI.MediaResource`) → native Fiori **download/preview link**.
+2. **Surfaceable detail (persisted today):** `sourceUrl` (GitHub raw URL, render as external link), `contentHash` (sha-256), `mimeType`, `channel`, child `filename` + `createdAt` + `status`. 
+3. **Byte size (D2):** add `byteSize : Integer64` to the schema and persist `buffer.length` at ingest (`srv/lib/image-ingest-handler.js` ~`:77`); width/height deferred.
+4. **UI:** "Media" facet with two tables (Images, Assets): thumbnail/download link, filename, mime, size (if added), source URL link, content hash, channel.
+
+**Design — Freshness header:**
+- Add a "Freshness Report" FieldGroup on the OP sourcing the latest `FreshnessReport` for the tutorial: `runAt`, `model`, `cost`, `status` (QUEUED/RUNNING/DONE/FAILED), `openHighCount`, `error`. Sits above the existing findings facet.
+
+**Testing:** unit — projections `@readonly`, media child annotations present; hybrid — a tutorial with ingested images shows rows + a working download link; freshness header reflects the latest report row.
+
+---
+
+## Cross-cutting constraints
+
+- **srv-qa cp-list:** every new `srv/lib/*.js` (contributors-publish, validation-rules-publish) and any new dep MUST be appended to the `cp` command in `.deploy/mta.yaml` (`tutorials-srv-qa`, ~`:175`), or QA boot fails with `MODULE_NOT_FOUND`.
+- **Schema/migration:** WS2 + WS3 (+ optional WS5 byteSize) add columns/entities → `cds build --production`, register in `db/persistence.cds` (`@cds.persistence.journal`), never hand-author `.hdbmigrationtable`. Run `npx cds deploy --to sqlite::memory:` before committing db changes.
+- **BLOB reads:** any raw content read stays `db.run()` (never mix LOB + metadata in one CDS QL query).
+- **QA namespace:** new publish routes need the `entity_not_in_model` guard + skip on `channel === 'qa'` if the QA CDS model lacks the entity.
+- **Feature-flag registry:** if any new `*Settings` Boolean column is introduced, register it (guard requirement); none currently planned.
+- **PR flow:** feature branch → PR targeting **DEV** (never main).
+
+## Suggested phasing
+
+- **Phase 1 (fixes your 3 empties):** WS1 (categories), WS2 (contributors), WS3 (validation). Highest user-visible payoff; shares the sidecar/publish pattern.
+- **Phase 2 (new visibility):** WS5 (media + freshness header) — you flagged media as the most exciting.
+- **Phase 3:** WS4 (KG facet) — additive, read-only, lowest risk but largest surface.
+
+Each workstream is independently shippable; phases can overlap. TDD throughout (unit + hybrid guards per workstream).
+
+## Out of scope (this design)
+
+- The S3/object-store prod binding investigation (D1) — separate ops task.
+- Learner submission pass-rate analytics, learning-path membership facet, audit-field surfacing — noted in the inventory as future candidates, not included here to keep scope focused.
diff --git a/docs/superpowers/specs/2026-09-01-tag-tree-topics-design.md b/docs/superpowers/specs/2026-09-01-tag-tree-topics-design.md
new file mode 100644
index 000000000..067f7a17f
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-01-tag-tree-topics-design.md
@@ -0,0 +1,154 @@
+# Tag-Tree Topics — Design
+
+**Date:** 2026-09-01
+**Status:** Draft for review
+**Issue/context:** `/topics/` is broken in production: every topic detail URL 404s, detail pages that render show no concepts, and the topics search box submits to a dead endpoint. This design rebuilds `/topics/` as a first-class subsystem with the same technical quality as `/concepts/`.
+
+---
+
+## 1. Problem statement (why topics is broken today)
+
+Three independent defects, all confirmed against the live site and the repo:
+
+1. **Every topic detail page 404s.** The approuter has a full dynamic per-slug serve path for concepts (`^/concepts/(.*)$` → `/content/concepts/$1`, served from HANA and rendered by `srv/lib/concept-detail-render.js`), but for topics **only the index route exists** (`^/topics/?$` → `/content/pages/topics/`). There is **no `/topics/(.*)` route**, so `/topics/<slug>/` — for any slug — falls through to a bare 404 (verified: the 404 carries no `x-content-source` header, i.e. it never reaches CAP). The Hugo-baked topic stubs are neither in the content-publish scope (`srv/lib/page-key-map.js` `IN_SCOPE_PAGES` lists only `page-topics`, the index) nor routed.
+
+2. **Detail pages show no concepts.** Topic detail (`hugo/layouts/topics/single.html`) reads `concepts[]` from the `/build/topics-gallery` payload (`srv/lib/build-topics-gallery.js`). That array is a `KgCommunity` (concept-vertex membership) → `Concepts.name` join. When the join returns nothing (empty/stale `KgCommunity` rows or slug-case mismatch), `concepts[]` is `[]` and the `{{ with $c.concepts }}` guard omits the whole section — while `memberCount`/`tutorialCount`, read straight off the `TopicClusters` row, still claim "N concepts". Counts and content come from different sources and disagree.
+
+3. **`/search/?q=` does nothing.** There is no `/search/` HTML page. `/search/` is the CAP `SearchService` **OData** endpoint. The topics search form (`hugo/layouts/topics/list.html:23`) does a full-page GET to `/search/?q=…`, landing on the OData service root, which ignores `?q=` (OData uses `$search=`) and renders no UI. The working search UI is the navigator island at `/tutorial-navigator/` (reads `?q=` via `hugo-apps/src/navigator/urlSync.ts`).
+
+Additional structural cause of link rot: the `/topics/` index currently links to ~501 slugs derived from **KG Louvain community labels**, which are **LLM-generated and non-deterministic** — they change on every KG rebuild, so previously valid `/topics/<slug>/` links stop existing. This is orthogonal to the routing gap but compounds it.
+
+---
+
+## 2. Goals & non-goals
+
+**Goals**
+- Topic detail pages resolve (200) with the same dynamic-slug serve architecture as concepts.
+- Topics are keyed by **stable, source-of-truth slugs** (SAP's central software tag hierarchy), so links do not rot.
+- Detail pages show **real, deterministically-populated concepts** plus the topic's tutorials.
+- `/topics/` presents a **tree navigation experience** over the tag hierarchy (facet → product → sub-product).
+- The topics search box reaches the working search UI.
+- Legacy AEM tag URLs resurrect **where the tag still has tutorials**; otherwise they redirect gracefully.
+
+**Non-goals (YAGNI / deferred)**
+- Curated editorial "learning-path" topics with hand-ordered concepts (`orderConcepts`, `orderMode: path`). The existing `TopicClusters`/`topics_gallery` learning-path UX can layer on top later; it is not required for parity and is not carried forward as the primary model.
+- KG Louvain communities as a public URL key (retained only for the homepage band, unchanged).
+- Resurrecting legacy URLs for retired products that have no current tutorials (impossible from a current-catalog source of truth).
+- A client-side-only tree (rejected for SEO/parity — see §5).
+
+---
+
+## 3. Topic model
+
+A **topic = a live SAP tag** (a tag currently applied to ≥1 tutorial). Tags come from SAP's central software hierarchy and are the source of truth already consumed by this platform, so slugs are stable and externally meaningful.
+
+Tag data (`/build/tags`, cached to `hugo/data/tags.json`) is `group>value`, 8 facet groups, 143 live tags, with a deeper `--` sub-level:
+
+- Facets: `software-product` (90), `software-product-function` (16), `programming-tool` (12), `topic` (11), `tutorial` (8), `deprecated-concepts` (3), `operating-system` (2), `type` (1).
+- Deep example: `software-product-function>sap-hana-cloud--data-lake` → `sap-hana-cloud` → `data-lake`.
+
+**Natural tree:** `facet → product → sub-product`. The hierarchy *is* the clustering — deterministic, no LLM.
+
+### Slug scheme
+- Topic slug = the flattened leaf value: `sap-hana-cloud--data-lake` → `sap-hana-cloud-data-lake`; `>` and `--` both collapse to `-`.
+- Matches the legacy AEM leaf-slug shape (`sap-hana-smart-data-streaming-development`), which is what enables legacy-URL resurrection.
+- **Collision handling:** build-time check across all leaves. On collision, facet-qualify the loser (`<facet>-<value>`). Expected rare; asserted in a unit test so a future tag import that introduces a collision fails loudly.
+
+---
+
+## 4. Data model — CAP builders
+
+Two new builder endpoints, both fed by existing sources; both fail-open (return empty payload + `error` field, matching the `build-topics-gallery.js` posture).
+
+### 4.1 `/build/topics-tree` (index payload)
+Builds the navigation tree:
+```
+{ tree: [ { facet, label, children: [ { slug, label, tutorialCount, conceptCount,
+                                        children: [ …sub-product leaves… ] } ] } ],
+  buildAt, error }
+```
+- Nodes/leaves from `/build/tags` (live tags only → every node has content).
+- Human labels from `/build/tag-labels`.
+- `tutorialCount` per tag from the existing tag→tutorial index.
+- `conceptCount` per tag from the concept-enrichment join (§4.2), so the tree can show concept density.
+
+### 4.2 `/build/topics/:slug` (detail payload)
+```
+{ slug, label, facet, rationale?,
+  tutorials: [ { slug, title, level, time, href, isNew } ],
+  concepts:  [ { slug, name, rank } ],   // deterministic — see below
+  relatedTags: [ { slug, label } ],       // siblings + children in the tree
+  buildAt, error }
+```
+- **Concepts populate deterministically** as: concepts linked (via existing `TutorialConceptLinks`) to the set of tutorials carrying this tag, deduped, ranked by `loadRankMaps()` conceptRank. This replaces the empty `KgCommunity` membership join that causes defect #2. Concepts link out to the existing `/concepts/<slug>/` pages.
+- `tutorials` from the tag→tutorial index (same source the navigator/facets use), lowercased slugs (`tutorialsTableInfo` helper) to avoid the known slug-case pitfall.
+- `relatedTags` = tree siblings + children, for cross-navigation.
+
+### 4.3 Reuse note
+`build-topics-gallery.js`, `TopicClusters`, and `topics_gallery.json` are **retired from the `/topics/` path** (the homepage `topic_clusters.json` band is untouched). We delete the two committed stub pages (`hugo/content/topics/btp-basics.md`, `cap-fundamentals.md`) and the `fetch-topics-gallery.ts` stub-generation. Any code deletion sweeps orphaned tests in the same commit.
+
+---
+
+## 5. Tree navigation UI — server-rendered + progressive island
+
+Matches the concepts-page pattern (server-rendered HTML + a small enhancing island), for SEO and no-JS resilience. **Critically, the index is CAP-rendered, not Hugo-static** — the original topics breakage came from Hugo-baked pages that no route served. `/concepts/` is fully CAP-rendered (`srv/lib/concept-list-page.js` behind `/content/concepts-index`); topics matches that exactly.
+
+- A new **`srv/lib/topic-list-page.js`** (mirroring `concept-list-page.js`), served at `/content/topics-index`, renders the full `facet → product → sub-product` tree from the `/build/topics-tree` payload as **semantic nested `<ul>`** with native `<details>/<summary>` disclosure — fully functional without JS, crawlable — wrapped in the shared chrome (`srv/lib/chrome-shell.js`). Published as a HANA content blob like the concepts index.
+- A **small Vue island** (`hugo-apps/src/topics-tree/`) progressively enhances: type-ahead filter, expand/collapse-all, deep-link to an expanded node. Mount is inert until JS loads (same posture as `concepts-filter.js`). Built into the island manifest; the CAP-rendered HTML embeds the hashed island `<script>` via the published island manifest (same mechanism concept pages use to embed islands).
+- Each leaf links to `/topics/<slug>/`.
+- The Hugo `topics` content section (`hugo/content/topics/`, `hugo/layouts/topics/`) and `hugo/data/topics_gallery.json` are retired; the index and detail are both CAP-rendered from `/build/*` payloads. `scripts/fetch-topics-tree.ts` still writes `hugo/data/topics_tree.json` only if we want the tree available to local Hugo dev preview — otherwise it is unnecessary (CAP is the single source). Design assumes **CAP-only** (no Hugo topics data file) for parity and simplicity; noted as open question 4.
+
+### 5.1 Topic detail page
+- Detail HTML is **generated by CAP at serve time** from the `/build/topics/:slug` payload, rendered by a new `srv/lib/topic-detail-render.js` (mirroring `concept-detail-render.js`), wrapped in the shared chrome (`srv/lib/chrome-shell.js`). It shows: title + facet breadcrumb, tutorials list, concepts list (linking to `/concepts/`), related tags, and the enhancing tree as context. This keeps topics on the identical serve mechanism as concepts rather than Hugo-static.
+
+---
+
+## 6. Serve / publish backbone — mirror concepts exactly
+
+- **Approuter** (`approuter/xs-app.json`): add
+  - `^/topics/?(\?.*)?$` → `/content/topics-index` (replaces the current `page-topics` route)
+  - `^/topics/(.*)$` → `/content/topics/$1`
+  - `^/build/(…|topics-tree)…` — add `topics-tree` to the existing `/build/*` allow-list regex.
+  - both `authenticationType: none` (public), like concepts.
+- **CAP** (`srv/server.js`): register `GET /content/topics-index` (index handler) and `GET /content/topics/:slug` (detail handler), mirroring the `/content/concepts-index` and `/content/concepts/:slug` registrations.
+- **Publish**: topic detail pages become **dynamic-slug content blobs in HANA**, published via the same path concepts use (`build-concepts.js` equivalent → a new `srv/lib/build-topics.js` producing per-slug blobs; a `topic-` key prefix + `discoverTopicPages`-style walker in `page-key-map.js`, analogous to the author/advocate dynamic-slug precedent already in that file). LOB reads use raw `db.run()` per the BLOB-locator rule.
+- **`srv-qa` cp-list audit**: any new `srv/lib/*` reachable from `content-store.js` must be added to `.deploy/mta.yaml`'s `srv-qa` `cp` list, and transitive `./` imports re-walked.
+
+### 6.1 Legacy / retired slug handling
+- Legacy `-N` numeric disambiguators (`…-development-2`) → strip suffix; if the base slug is a live topic, **301** to it.
+- Retired-product slugs with no live tag → **301 to `/topics/`** (or nearest live parent facet if resolvable). Implemented as a small slug-normalization step in the detail handler before 404.
+
+---
+
+## 7. Search fix (independent, small)
+
+- Repoint the topics search form action and empty-state link (`hugo/layouts/topics/list.html`) from `/search/` to **`/tutorial-navigator/`** (keeps `name="q"`; navigator reads `?q=` via `urlSync.ts`).
+- Add an approuter **301 `^/search/(\?.*)?$` → `/tutorial-navigator/$1`** so any external `/search/?q=` links (and the OData collision) resolve to the real UI. Verify this does not shadow the OData `SearchService` data routes (`^/search/(.*)$` → `/search/$1`): scope the redirect to the bare `/search/` + query only, leaving `/search/SearchableItems` etc. intact.
+
+---
+
+## 8. Testing
+
+- **Unit:** tree builder (facet grouping, `--` sub-nesting, counts), slug flattening + collision assertion, concept-enrichment join (tag→tutorials→concepts dedup/rank), legacy-slug normalization/redirect logic. Use `cds.test('serve', …, '--in-memory')` bootstrap (not `cds.deploy(cds.model)`).
+- **Hybrid** (`--project hybrid`, real HANA via `cds bind --exec`): `/build/topics-tree` and `/build/topics/:slug` return non-empty against real tag + KG data; publish→serve round-trip for a sample topic blob; slug-case correctness.
+- **e2e** (committed spec in `test/e2e/`, post-deploy, self-skipping): `/topics/` renders the tree; a leaf navigates to a `/topics/<slug>/` detail page that shows tutorials + concepts; search box lands on `/tutorial-navigator/?q=`. (User-facing UI change → repo convention wants a committed e2e spec.)
+- **Smoke:** new `/topics/<slug>/` and `/topics/` routes return 200 with expected `x-content-source`.
+- Pre-commit for any `db/**/*.cds` change: `npx cds deploy --to sqlite::memory:`; `cds build --production` after schema changes (never hand-author migration tables).
+
+---
+
+## 9. Rollout & risk
+
+- **Branch/PR:** implement on a branch off **`origin/DEV`** (this repo's PRs target DEV; `main` is protected — no direct-to-main path). Rebase this worktree onto `origin/DEV` before implementation.
+- **Data dependency:** concept enrichment needs `TutorialConceptLinks` populated in the target env; if empty, concepts render empty but tutorials + tree still work (fail-open, no 500).
+- **Deploy:** admin/serve changes need a full MTA deploy; content (topic blobs) published via `gh workflow run rebuild-content.yml`, not a workstation. Confirm deploy scope with maintainer.
+- **Reversibility:** the old `page-topics` index route can be restored by reverting the approuter diff; topic blobs are additive in HANA.
+
+---
+
+## 10. Open questions for reviewer
+
+1. Slug scheme: bare leaf (`sap-hana-cloud-data-lake`) vs facet-qualified always (`software-product-function-sap-hana-cloud-data-lake`)? Design assumes bare-leaf + qualify-on-collision (best legacy-URL match).
+2. Should retired-product legacy URLs 301 to the facet parent, or always to `/topics/`? Design assumes `/topics/` unless a live parent is trivially resolvable.
+3. Is a persistent left-rail tree on detail pages wanted later, or is index-tree + related-tags sufficient? Design ships the latter (YAGNI); left-rail is a clean follow-up.
+4. CAP-only rendering (no Hugo topics data file) vs also writing `hugo/data/topics_tree.json` for local Hugo dev preview? Design assumes CAP-only for parity/simplicity.
diff --git a/hugo-apps/src/devtoberfest-schedule-shared/DetailPanel.vue b/hugo-apps/src/devtoberfest-schedule-shared/DetailPanel.vue
index 382808a99..ad453069f 100644
--- a/hugo-apps/src/devtoberfest-schedule-shared/DetailPanel.vue
+++ b/hugo-apps/src/devtoberfest-schedule-shared/DetailPanel.vue
@@ -4,6 +4,7 @@ import { youtubeThumb, safeHref, taskHref, taskLinkLabel } from './completion';
 import { youtubeId, youtubeEmbedUrl } from './youtube';
 import { formatViewerLocal } from './format-session-time';
 import { sessionIcsHref, sessionCalendarHref } from './calendar-links';
+import { broadcastingTag } from './broadcasting';
 import { renderMarkdown } from '../devtoberfest-shared/render-markdown';
 import { computed, ref } from 'vue';
 
@@ -100,6 +101,8 @@ const abstractHtml = computed(() => {
   return raw ? renderMarkdown(raw) : '';
 });
 
+const formatTag = computed(() => broadcastingTag((props.row as any)?.broadcastingPreference));
+
 </script>
 
 <template>
@@ -150,6 +153,12 @@ const abstractHtml = computed(() => {
         <div v-if="abstractHtml" class="detail-panel__abstract" v-html="abstractHtml"></div>
 
         <dl class="detail-panel__meta">
+          <template v-if="formatTag">
+            <dt>Format</dt>
+            <dd>
+              <span class="sg-badge" :class="`sg-badge--${formatTag.modifier}`">{{ formatTag.icon }} {{ formatTag.label }}</span>
+            </dd>
+          </template>
           <template v-if="(row as any).trackName">
             <dt>Track</dt>
             <dd>{{ (row as any).trackName }}</dd>
@@ -349,6 +358,25 @@ const abstractHtml = computed(() => {
   margin: 0;
 }
 
+.sg-badge {
+  display: inline-block;
+  padding: 0.05rem 0.45rem;
+  border-radius: 20px;
+  font-size: 0.72rem;
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.sg-badge--live {
+  background: var(--sapErrorBackground, #ffebeb);
+  color: var(--sapNegativeColor, #b00020);
+}
+
+.sg-badge--prerecorded {
+  background: var(--sapNeutralBackground, #f5f6f7);
+  color: var(--sapContent_LabelColor, #6a6d70);
+}
+
 .detail-panel__links {
   display: flex;
   flex-direction: column;
diff --git a/hugo-apps/src/devtoberfest-schedule-shared/__tests__/broadcasting.test.ts b/hugo-apps/src/devtoberfest-schedule-shared/__tests__/broadcasting.test.ts
new file mode 100644
index 000000000..5d68bb338
--- /dev/null
+++ b/hugo-apps/src/devtoberfest-schedule-shared/__tests__/broadcasting.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest';
+import { broadcastingTag, matchesFormat, FORMAT_FILTER_OPTIONS } from '../broadcasting';
+
+describe('broadcasting helper', () => {
+  it('maps Live and PreRecorded to display tags', () => {
+    const live = broadcastingTag('Live');
+    expect(live).toMatchObject({ value: 'Live', label: 'Live', modifier: 'live' });
+    const rec = broadcastingTag('PreRecorded');
+    expect(rec).toMatchObject({ value: 'PreRecorded', label: 'Prerecorded', modifier: 'prerecorded' });
+    expect(live!.icon).toBeTruthy();
+    expect(rec!.icon).toBeTruthy();
+  });
+
+  it('returns null for unset/unrecognized preferences (no tag)', () => {
+    expect(broadcastingTag(null)).toBeNull();
+    expect(broadcastingTag(undefined)).toBeNull();
+    expect(broadcastingTag('Whatever' as any)).toBeNull();
+  });
+
+  it('empty filter matches everything, including unset', () => {
+    expect(matchesFormat('Live', '')).toBe(true);
+    expect(matchesFormat('PreRecorded', '')).toBe(true);
+    expect(matchesFormat(null, '')).toBe(true);
+    expect(matchesFormat(null, null)).toBe(true);
+  });
+
+  it('set filter requires exact match; unset is excluded', () => {
+    expect(matchesFormat('Live', 'Live')).toBe(true);
+    expect(matchesFormat('PreRecorded', 'Live')).toBe(false);
+    expect(matchesFormat('PreRecorded', 'PreRecorded')).toBe(true);
+    expect(matchesFormat(null, 'Live')).toBe(false);
+    expect(matchesFormat(null, 'PreRecorded')).toBe(false);
+  });
+
+  it('exposes All/Live/Prerecorded filter options in order', () => {
+    expect(FORMAT_FILTER_OPTIONS.map((o) => o.value)).toEqual(['', 'Live', 'PreRecorded']);
+  });
+});
diff --git a/hugo-apps/src/devtoberfest-schedule-shared/broadcasting.ts b/hugo-apps/src/devtoberfest-schedule-shared/broadcasting.ts
new file mode 100644
index 000000000..faa215acf
--- /dev/null
+++ b/hugo-apps/src/devtoberfest-schedule-shared/broadcasting.ts
@@ -0,0 +1,49 @@
+// Pure, DOM-free helpers for the session broadcasting-format tag + filter
+// (Live vs Prerecorded — issue #2110). Shared by the sessions grid, calendar,
+// and schedule-table views plus the DetailPanel so the visual tag and the
+// "Format" filter behave identically everywhere.
+//
+// The feed normalizes the free-text planner field to exactly 'Live',
+// 'PreRecorded', or null (see srv/lib/devtoberfest-feed.js
+// normalizeBroadcastingPreference). Sessions with no preference (null) show no
+// tag and are excluded from both the Live and Prerecorded filters.
+
+export type BroadcastPref = 'Live' | 'PreRecorded' | null | undefined;
+
+export interface BroadcastTag {
+  /** Canonical value ('Live' | 'PreRecorded'). */
+  readonly value: 'Live' | 'PreRecorded';
+  /** Human-readable pill label. */
+  readonly label: string;
+  /** CSS modifier suffix, e.g. 'live' → .sg-badge--live. */
+  readonly modifier: string;
+  /** Small leading glyph for the pill. */
+  readonly icon: string;
+}
+
+/**
+ * Map a normalized broadcasting preference to its display tag, or null when
+ * unset/unrecognized (→ no tag rendered).
+ */
+export function broadcastingTag(pref: BroadcastPref): BroadcastTag | null {
+  if (pref === 'Live') return { value: 'Live', label: 'Live', modifier: 'live', icon: '🔴' };
+  if (pref === 'PreRecorded') return { value: 'PreRecorded', label: 'Prerecorded', modifier: 'prerecorded', icon: '▶' };
+  return null;
+}
+
+/** Filter dropdown options, in display order. Empty value = no filter. */
+export const FORMAT_FILTER_OPTIONS: ReadonlyArray<{ value: string; label: string }> = Object.freeze([
+  { value: '', label: 'All formats' },
+  { value: 'Live', label: 'Live' },
+  { value: 'PreRecorded', label: 'Prerecorded' },
+]);
+
+/**
+ * Does a session's preference satisfy the current Format filter? An empty
+ * filter matches everything; a set filter requires an exact match, so null
+ * (unset) sessions are excluded from both Live and Prerecorded.
+ */
+export function matchesFormat(pref: BroadcastPref, filter: string | null | undefined): boolean {
+  if (!filter) return true;
+  return pref === filter;
+}
diff --git a/hugo-apps/src/devtoberfest-schedule-shared/types.ts b/hugo-apps/src/devtoberfest-schedule-shared/types.ts
index 69b17246f..bbfe87d1c 100644
--- a/hugo-apps/src/devtoberfest-schedule-shared/types.ts
+++ b/hugo-apps/src/devtoberfest-schedule-shared/types.ts
@@ -1,5 +1,5 @@
 export interface Edition { id: string; name: string; year?: string; isCurrent: boolean; startsAt?: string; endsAt?: string; timeZone?: string }
-export interface Session { id: string; kind: 'session'; title: string; abstract?: string; sessionCode?: string; sessionLength?: string; trackId?: string; trackName?: string; trackDay?: string; week?: string; scheduledStart?: string; scheduledTimeZone?: string; recordingStart?: string; youtubeUrl?: string; communityEventUrl?: string; activityId?: string | null; status?: string; linkedinUrl?: string; speakers?: Speaker[]; trackColor?: string; trackEmoji?: string }
+export interface Session { id: string; kind: 'session'; title: string; abstract?: string; sessionCode?: string; sessionLength?: string; broadcastingPreference?: 'Live' | 'PreRecorded' | null; trackId?: string; trackName?: string; trackDay?: string; week?: string; scheduledStart?: string; scheduledTimeZone?: string; recordingStart?: string; youtubeUrl?: string; communityEventUrl?: string; activityId?: string | null; status?: string; linkedinUrl?: string; speakers?: Speaker[]; trackColor?: string; trackEmoji?: string }
 export interface Activity { id: string; kind: 'activity'; title: string; week?: string; points: number; trackId?: string; trackName?: string; taskType?: string; taskSlug?: string; taskTitle?: string; taskId?: string; status?: string }
 export interface Speaker { id: string; name: string; role?: string; company?: string; bio?: string; photoUrl?: string }
 export interface Feed { activeEditionId: string | null; editions: Edition[]; sessions: Session[]; activities: Activity[] }
diff --git a/hugo-apps/src/devtoberfest-schedule/App.vue b/hugo-apps/src/devtoberfest-schedule/App.vue
index f9c038337..48f86f277 100644
--- a/hugo-apps/src/devtoberfest-schedule/App.vue
+++ b/hugo-apps/src/devtoberfest-schedule/App.vue
@@ -2,6 +2,7 @@
 import { ref, computed, onMounted, reactive } from 'vue';
 import { fetchFeed, fetchMyCompletions } from '../devtoberfest-schedule-shared/feed';
 import { mergeCompletion, safeHref, taskHref, taskLinkLabel } from '../devtoberfest-schedule-shared/completion';
+import { broadcastingTag, matchesFormat, FORMAT_FILTER_OPTIONS } from '../devtoberfest-schedule-shared/broadcasting';
 import EditionPicker from '../devtoberfest-schedule-shared/EditionPicker.vue';
 import PointsBanner from '../devtoberfest-schedule-shared/PointsBanner.vue';
 import DetailPanel from '../devtoberfest-schedule-shared/DetailPanel.vue';
@@ -24,6 +25,7 @@ const filters = reactive({
   week: '',
   type: '',
   track: '',
+  format: '',
   q: '',
 });
 
@@ -65,6 +67,7 @@ const filtered = computed(() => {
     if (filters.week && r.week !== filters.week) return false;
     if (filters.type && r.kind !== filters.type) return false;
     if (filters.track && (r as any).trackName !== filters.track) return false;
+    if (!matchesFormat((r as any).broadcastingPreference, filters.format)) return false;
     if (q && !r.title.toLowerCase().includes(q)) return false;
     return true;
   });
@@ -119,6 +122,7 @@ function clearFilters() {
   filters.week = '';
   filters.type = '';
   filters.track = '';
+  filters.format = '';
   filters.q = '';
 }
 
@@ -189,8 +193,14 @@ defineExpose({ filters });
             <option v-for="t in trackOptions" :key="t" :value="t">{{ t }}</option>
           </select>
         </label>
+        <label class="sched-field">
+          <span>Format</span>
+          <select v-model="filters.format" aria-label="Filter by session format">
+            <option v-for="opt in FORMAT_FILTER_OPTIONS" :key="opt.value" :value="opt.value">{{ opt.label }}</option>
+          </select>
+        </label>
         <button
-          v-if="filters.week || filters.type || filters.track || filters.q"
+          v-if="filters.week || filters.type || filters.track || filters.format || filters.q"
           class="sched-btn sched-btn-ghost"
           @click="clearFilters"
         >Clear</button>
@@ -212,6 +222,7 @@ defineExpose({ filters });
               <th @click="setSort('kind')"><button>Type{{ sortIcon('kind') }}</button></th>
               <th @click="setSort('title')"><button>Title{{ sortIcon('title') }}</button></th>
               <th @click="setSort('trackName')"><button>Track{{ sortIcon('trackName') }}</button></th>
+              <th>Format</th>
               <th @click="setSort('week')"><button>Week{{ sortIcon('week') }}</button></th>
               <th @click="setSort('scheduledStart')"><button>Date / Time{{ sortIcon('scheduledStart') }}</button></th>
               <th @click="setSort('points')" class="num"><button>Points{{ sortIcon('points') }}</button></th>
@@ -236,6 +247,14 @@ defineExpose({ filters });
               </td>
               <td class="sched-title-cell">{{ row.title }}</td>
               <td>{{ (row as any).trackName ?? '—' }}</td>
+              <td>
+                <span
+                  v-if="broadcastingTag((row as any).broadcastingPreference)"
+                  class="sched-fmt-badge"
+                  :class="`sched-fmt-badge--${broadcastingTag((row as any).broadcastingPreference)!.modifier}`"
+                >{{ broadcastingTag((row as any).broadcastingPreference)!.icon }} {{ broadcastingTag((row as any).broadcastingPreference)!.label }}</span>
+                <template v-else>—</template>
+              </td>
               <td>{{ row.week ?? '—' }}</td>
               <td>
                 <template v-if="(row as any).scheduledStart">
@@ -492,6 +511,25 @@ defineExpose({ filters });
   color: var(--sapPositiveColor, #107e3e);
 }
 
+.sched-fmt-badge {
+  display: inline-block;
+  padding: 0.1rem 0.4rem;
+  border-radius: 0.75rem;
+  font-size: 0.75rem;
+  font-weight: 600;
+  white-space: nowrap;
+}
+
+.sched-fmt-badge--live {
+  background: var(--sapErrorBackground, #ffebeb);
+  color: var(--sapNegativeColor, #b00020);
+}
+
+.sched-fmt-badge--prerecorded {
+  background: var(--sapNeutralBackground, #f5f6f7);
+  color: var(--sapContent_LabelColor, #6a6d70);
+}
+
 .sched-done {
   color: var(--sapPositiveColor, #107e3e);
   font-weight: 700;
diff --git a/hugo-apps/src/devtoberfest-schedule/__tests__/App.test.ts b/hugo-apps/src/devtoberfest-schedule/__tests__/App.test.ts
index 0f54cea1a..e04dc952e 100644
--- a/hugo-apps/src/devtoberfest-schedule/__tests__/App.test.ts
+++ b/hugo-apps/src/devtoberfest-schedule/__tests__/App.test.ts
@@ -6,7 +6,10 @@ import App from '../App.vue';
 const feed = {
   activeEditionId: 'e1',
   editions: [{ id: 'e1', name: '2026', isCurrent: true }],
-  sessions: [{ id: 's1', kind: 'session', title: 'Intro Session', trackName: 'ABAP', week: '1', scheduledStart: '2026-10-05T14:00:00Z', scheduledTimeZone: 'Europe/Berlin', activityId: 'a1' }],
+  sessions: [
+    { id: 's1', kind: 'session', title: 'Intro Session', trackName: 'ABAP', week: '1', scheduledStart: '2026-10-05T14:00:00Z', scheduledTimeZone: 'Europe/Berlin', activityId: 'a1', broadcastingPreference: 'Live' },
+    { id: 's2', kind: 'session', title: 'Replay Session', trackName: 'ABAP', week: '1', scheduledStart: '2026-10-06T14:00:00Z', scheduledTimeZone: 'Europe/Berlin', broadcastingPreference: 'PreRecorded' },
+  ],
   activities: [{ id: 'a1', kind: 'activity', title: 'Do Intro', trackName: 'ABAP', week: '1', points: 500, taskType: 'TUTORIAL', taskSlug: 'intro' }],
 };
 
@@ -37,4 +40,20 @@ describe('Schedule table', () => {
     await wrapper.vm.$nextTick();
     expect(wrapper.text()).not.toContain('Intro Session');
   });
+
+  it('renders Live/Prerecorded format badges', async () => {
+    const wrapper = mount(App);
+    await flushPromises();
+    expect(wrapper.text()).toContain('Live');
+    expect(wrapper.text()).toContain('Prerecorded');
+  });
+
+  it('filters by format (Live excludes Prerecorded)', async () => {
+    const wrapper = mount(App);
+    await flushPromises();
+    (wrapper.vm as any).filters.format = 'Live';
+    await wrapper.vm.$nextTick();
+    expect(wrapper.text()).toContain('Intro Session');
+    expect(wrapper.text()).not.toContain('Replay Session');
+  });
 });
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/App.vue b/hugo-apps/src/devtoberfest-sessions-calendar/App.vue
index 64e7e8d1f..9dff73549 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/App.vue
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/App.vue
@@ -3,6 +3,7 @@
 import { ref, computed, onMounted, onBeforeUnmount, watch } from 'vue';
 import { fetchFeed, fetchMyCompletions } from '../devtoberfest-schedule-shared/feed';
 import { mergeCompletion } from '../devtoberfest-schedule-shared/completion';
+import { broadcastingTag, matchesFormat, FORMAT_FILTER_OPTIONS } from '../devtoberfest-schedule-shared/broadcasting';
 import { useAuth } from '../devtoberfest-schedule-shared/useAuth';
 import EditionPicker from '../devtoberfest-schedule-shared/EditionPicker.vue';
 import PointsBanner from '../devtoberfest-schedule-shared/PointsBanner.vue';
@@ -33,6 +34,7 @@ const maxPoints = ref(0);
 const joined = ref(false);
 const selectedRow = ref<ScheduleRow | null>(null);
 const filterTrack = ref('');
+const filterFormat = ref('');
 const viewMode = ref<ViewMode>('month');
 const cursor = ref<Date>(new Date());
 
@@ -53,6 +55,7 @@ let applied = false;
 
 if (initialUrl.view) viewMode.value = initialUrl.view;
 if (initialUrl.track) filterTrack.value = initialUrl.track;
+if (initialUrl.format) filterFormat.value = initialUrl.format;
 
 const MONTHS = ['January','February','March','April','May','June','July','August','September','October','November','December'];
 
@@ -141,7 +144,11 @@ const completeCount = computed(() => sessions.value.filter((r) => r.complete).le
 
 const filteredSessions = computed<Session[]>(() => {
   const base = sessions.value as Session[];
-  return filterTrack.value ? base.filter((r) => (r as any).trackName === filterTrack.value) : base;
+  return base.filter((r) => {
+    if (filterTrack.value && (r as any).trackName !== filterTrack.value) return false;
+    if (!matchesFormat((r as any).broadcastingPreference, filterFormat.value)) return false;
+    return true;
+  });
 });
 
 const byDate = computed(() => groupByDate(filteredSessions.value));
@@ -185,6 +192,7 @@ function currentUrlState(): CalendarUrlState {
     date: cur !== initialCursorIso.value ? cur : null,
     session: selectedRow.value?.id ?? null,
     track: filterTrack.value || null,
+    format: filterFormat.value || null,
     // Omit edition when it's just the active default — the ?edition param is
     // for explicitly viewing a non-active edition.
     edition: editionId.value && editionId.value !== feed.value?.activeEditionId
@@ -203,6 +211,7 @@ function writeUrl() {
 function applyFromUrl(st: CalendarUrlState) {
   viewMode.value = st.view ?? 'month';
   filterTrack.value = st.track ?? '';
+  filterFormat.value = st.format ?? '';
   let anchored = false;
   if (st.session) {
     const row = sessions.value.find((r) => r.id === st.session);
@@ -231,7 +240,7 @@ onMounted(async () => {
 
 onBeforeUnmount(() => window.removeEventListener('popstate', onPopState));
 
-watch([viewMode, cursor, filterTrack, editionId, selectedRow], writeUrl);
+watch([viewMode, cursor, filterTrack, filterFormat, editionId, selectedRow], writeUrl);
 </script>
 
 <template>
@@ -274,6 +283,12 @@ watch([viewMode, cursor, filterTrack, editionId, selectedRow], writeUrl);
             <option v-for="t in trackOptions" :key="t" :value="t">{{ t }}</option>
           </select>
         </label>
+        <label class="sc-field cal-filter">
+          <span class="sr-only">Format</span>
+          <select v-model="filterFormat" aria-label="Filter by session format">
+            <option v-for="opt in FORMAT_FILTER_OPTIONS" :key="opt.value" :value="opt.value">{{ opt.label }}</option>
+          </select>
+        </label>
         <div class="cal-switch" role="tablist">
           <button :class="{ active: viewMode === 'month' }" @click="viewMode = 'month'">Month</button>
           <button :class="{ active: viewMode === 'week' }" @click="viewMode = 'week'">Week</button>
@@ -305,6 +320,11 @@ watch([viewMode, cursor, filterTrack, editionId, selectedRow], writeUrl);
             @click="selectedRow = s as any"
           >
             <span class="cal-unscheduled-name">{{ s.title }}</span>
+            <span
+              v-if="broadcastingTag((s as any).broadcastingPreference)"
+              class="sg-badge cal-unscheduled-format"
+              :class="`sg-badge--${broadcastingTag((s as any).broadcastingPreference)!.modifier}`"
+            >{{ broadcastingTag((s as any).broadcastingPreference)!.icon }} {{ broadcastingTag((s as any).broadcastingPreference)!.label }}</span>
             <span v-if="s.trackName" class="cal-unscheduled-track">{{ s.trackName }}</span>
             <span v-if="isAuthenticated && (s as any).complete" class="cal-unscheduled-done" aria-label="Completed">✓</span>
           </button>
@@ -349,4 +369,7 @@ watch([viewMode, cursor, filterTrack, editionId, selectedRow], writeUrl);
 .cal-unscheduled-name { font-size: 0.8rem; font-weight: 600; }
 .cal-unscheduled-track { font-size: 0.7rem; color: var(--sapContent_LabelColor, #6a6d70); }
 .cal-unscheduled-done { color: var(--sapPositiveColor, #107e3e); font-size: 0.7rem; font-weight: 700; }
+.sg-badge { display: inline-block; padding: 0.05rem 0.4rem; border-radius: 20px; font-size: 0.68rem; font-weight: 600; white-space: nowrap; }
+.sg-badge--live { background: var(--sapErrorBackground, #ffebeb); color: var(--sapNegativeColor, #b00020); }
+.sg-badge--prerecorded { background: var(--sapNeutralBackground, #f5f6f7); color: var(--sapContent_LabelColor, #6a6d70); }
 </style>
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/DayAgenda.vue b/hugo-apps/src/devtoberfest-sessions-calendar/DayAgenda.vue
index e280f0e15..004eac636 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/DayAgenda.vue
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/DayAgenda.vue
@@ -6,6 +6,7 @@ import type { TrackColor } from './track-colors';
 import type { Session } from '../devtoberfest-schedule-shared/types';
 import { youtubeThumb, speakerNames } from '../devtoberfest-schedule-shared/completion';
 import { formatViewerLocal } from '../devtoberfest-schedule-shared/format-session-time';
+import { broadcastingTag } from '../devtoberfest-schedule-shared/broadcasting';
 
 const props = defineProps<{
   cursor: Date;
@@ -49,6 +50,11 @@ function onThumbError(ev: Event) {
       <div class="da-meta">
         <span v-if="s.scheduledStart" class="da-time">{{ formatViewerLocal(s.scheduledStart) }}</span>
         <span class="da-title">{{ s.title }}</span>
+        <span
+          v-if="broadcastingTag((s as any).broadcastingPreference)"
+          class="sg-badge da-fmt"
+          :class="`sg-badge--${broadcastingTag((s as any).broadcastingPreference)!.modifier}`"
+        >{{ broadcastingTag((s as any).broadcastingPreference)!.icon }} {{ broadcastingTag((s as any).broadcastingPreference)!.label }}</span>
         <span v-if="speakerNames(s)" class="da-speakers">{{ speakerNames(s) }}</span>
         <span v-if="s.trackName" class="da-track">{{ s.trackName }}</span>
         <span v-if="isAuthenticated && (s as any).complete" class="da-done" aria-label="Completed">✓ Completed</span>
@@ -76,4 +82,7 @@ function onThumbError(ev: Event) {
 .da-speakers { font-size: 0.78rem; color: var(--sapContent_LabelColor, #6a6d70); }
 .da-track { font-size: 0.72rem; color: var(--sapContent_LabelColor, #6a6d70); }
 .da-done { font-size: 0.72rem; color: var(--sapPositiveColor, #107e3e); font-weight: 700; }
+.sg-badge { display: inline-block; align-self: flex-start; padding: 0.05rem 0.4rem; border-radius: 20px; font-size: 0.68rem; font-weight: 600; white-space: nowrap; }
+.sg-badge--live { background: var(--sapErrorBackground, #ffebeb); color: var(--sapNegativeColor, #b00020); }
+.sg-badge--prerecorded { background: var(--sapNeutralBackground, #f5f6f7); color: var(--sapContent_LabelColor, #6a6d70); }
 </style>
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/MonthGrid.vue b/hugo-apps/src/devtoberfest-sessions-calendar/MonthGrid.vue
index 78201b886..794d39326 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/MonthGrid.vue
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/MonthGrid.vue
@@ -6,6 +6,7 @@ import type { TrackColor } from './track-colors';
 import type { Session } from '../devtoberfest-schedule-shared/types';
 import { formatViewerTimeShort } from '../devtoberfest-schedule-shared/format-session-time';
 import { speakerNames } from '../devtoberfest-schedule-shared/completion';
+import { broadcastingTag } from '../devtoberfest-schedule-shared/broadcasting';
 
 const props = withDefaults(defineProps<{
   cursor: Date;
@@ -89,6 +90,13 @@ onBeforeUnmount(() => window.removeEventListener('keydown', onKeydown));
             :title="chipTitle(s)"
           >
             <span v-if="s.scheduledStart" class="mg-chip-t">{{ formatViewerTimeShort(s.scheduledStart) }}</span>
+            <span
+              v-if="broadcastingTag((s as any).broadcastingPreference)"
+              class="mg-chip-fmt"
+              :class="`mg-chip-fmt--${broadcastingTag((s as any).broadcastingPreference)!.modifier}`"
+              :aria-label="broadcastingTag((s as any).broadcastingPreference)!.label"
+              :title="broadcastingTag((s as any).broadcastingPreference)!.label"
+            >{{ broadcastingTag((s as any).broadcastingPreference)!.icon }}</span>
             <span class="mg-chip-n">{{ s.title }}</span>
           </button>
         </template>
@@ -122,6 +130,13 @@ onBeforeUnmount(() => window.removeEventListener('keydown', onKeydown));
               :title="chipTitle(s)"
             >
               <span v-if="s.scheduledStart" class="mg-chip-t">{{ formatViewerTimeShort(s.scheduledStart) }}</span>
+              <span
+                v-if="broadcastingTag((s as any).broadcastingPreference)"
+                class="mg-chip-fmt"
+                :class="`mg-chip-fmt--${broadcastingTag((s as any).broadcastingPreference)!.modifier}`"
+                :aria-label="broadcastingTag((s as any).broadcastingPreference)!.label"
+                :title="broadcastingTag((s as any).broadcastingPreference)!.label"
+              >{{ broadcastingTag((s as any).broadcastingPreference)!.icon }}</span>
               <span class="mg-chip-n">{{ s.title }}</span>
             </button>
           </div>
@@ -163,6 +178,9 @@ onBeforeUnmount(() => window.removeEventListener('keydown', onKeydown));
 }
 .mg-chip--complete { outline: 1px solid var(--sapSuccessBorderColor, #107e3e); }
 .mg-chip-t { flex: 0 0 auto; font-variant-numeric: tabular-nums; opacity: 0.75; }
+.mg-chip-fmt { flex: 0 0 auto; font-size: 0.7rem; line-height: 1; }
+.mg-chip-fmt--live { color: var(--sapNegativeColor, #b00020); }
+.mg-chip-fmt--prerecorded { opacity: 0.6; }
 .mg-chip-n { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .mg-more { align-self: flex-start; border: none; background: transparent; cursor: pointer; font: inherit;
   font-size: 0.72rem; font-weight: 600; color: var(--sapLinkColor, #0a6ed1); padding: 0.1rem 0.25rem; }
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/WeekAgenda.vue b/hugo-apps/src/devtoberfest-sessions-calendar/WeekAgenda.vue
index a20f5a508..816ce2d8d 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/WeekAgenda.vue
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/WeekAgenda.vue
@@ -6,6 +6,7 @@ import type { TrackColor } from './track-colors';
 import type { Session } from '../devtoberfest-schedule-shared/types';
 import { formatViewerLocal } from '../devtoberfest-schedule-shared/format-session-time';
 import { speakerNames } from '../devtoberfest-schedule-shared/completion';
+import { broadcastingTag } from '../devtoberfest-schedule-shared/broadcasting';
 
 const props = defineProps<{
   cursor: Date;
@@ -43,6 +44,11 @@ function borderColor(s: Session): string {
         >
           <span v-if="s.scheduledStart" class="wk-t">{{ formatViewerLocal(s.scheduledStart) }}</span>
           <span class="wk-n">{{ s.title }}</span>
+          <span
+            v-if="broadcastingTag((s as any).broadcastingPreference)"
+            class="sg-badge wk-fmt"
+            :class="`sg-badge--${broadcastingTag((s as any).broadcastingPreference)!.modifier}`"
+          >{{ broadcastingTag((s as any).broadcastingPreference)!.icon }} {{ broadcastingTag((s as any).broadcastingPreference)!.label }}</span>
           <span v-if="speakerNames(s)" class="wk-sp">{{ speakerNames(s) }}</span>
           <span v-if="isAuthenticated && (s as any).complete" class="wk-done" aria-label="Completed">✓</span>
         </button>
@@ -73,5 +79,8 @@ function borderColor(s: Session): string {
 .wk-n { display: block; font-size: 0.75rem; font-weight: 600; line-height: 1.25; }
 .wk-sp { display: block; font-size: 0.7rem; color: var(--sapContent_LabelColor, #6a6d70); line-height: 1.2; margin-top: 0.1rem; }
 .wk-done { color: var(--sapPositiveColor, #107e3e); font-size: 0.7rem; font-weight: 700; }
+.sg-badge { display: inline-block; margin-top: 0.2rem; padding: 0.02rem 0.35rem; border-radius: 20px; font-size: 0.65rem; font-weight: 600; white-space: nowrap; }
+.sg-badge--live { background: var(--sapErrorBackground, #ffebeb); color: var(--sapNegativeColor, #b00020); }
+.sg-badge--prerecorded { background: var(--sapNeutralBackground, #f5f6f7); color: var(--sapContent_LabelColor, #6a6d70); }
 .wk-empty { color: var(--sapContent_DisabledTextColor, #b0b0b0); font-size: 0.75rem; text-align: center; padding: 0.75rem 0; }
 </style>
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/__tests__/url-state.test.ts b/hugo-apps/src/devtoberfest-sessions-calendar/__tests__/url-state.test.ts
index f0498a113..b10676a70 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/__tests__/url-state.test.ts
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/__tests__/url-state.test.ts
@@ -21,12 +21,13 @@ describe('parseCalendarUrl', () => {
   });
 
   it('parses every recognised param', () => {
-    const s = parseCalendarUrl('?view=week&date=2026-10-05&session=abc-123&track=Cloud%20%26%20AI&edition=dtf-2026');
+    const s = parseCalendarUrl('?view=week&date=2026-10-05&session=abc-123&track=Cloud%20%26%20AI&format=Live&edition=dtf-2026');
     expect(s).toEqual({
       view: 'week',
       date: '2026-10-05',
       session: 'abc-123',
       track: 'Cloud & AI', // URL-decoded
+      format: 'Live',
       edition: 'dtf-2026',
     });
   });
@@ -47,12 +48,18 @@ describe('parseCalendarUrl', () => {
   });
 
   it('treats empty session/track/edition as null', () => {
-    const s = parseCalendarUrl('session=&track=&edition=');
+    const s = parseCalendarUrl('session=&track=&format=&edition=');
     expect(s.session).toBeNull();
     expect(s.track).toBeNull();
+    expect(s.format).toBeNull();
     expect(s.edition).toBeNull();
   });
 
+  it('parses the format filter (Live | PreRecorded)', () => {
+    expect(parseCalendarUrl('format=Live').format).toBe('Live');
+    expect(parseCalendarUrl('format=PreRecorded').format).toBe('PreRecorded');
+  });
+
   it('accepts a URLSearchParams instance directly', () => {
     const s = parseCalendarUrl(new URLSearchParams({ view: 'day', session: 'x' }));
     expect(s.view).toBe('day');
@@ -76,6 +83,7 @@ describe('toCalendarQuery', () => {
       date: '2026-10-05',
       session: 'abc-123',
       track: 'Cloud & AI',
+      format: 'PreRecorded',
       edition: 'dtf-2026',
     });
     const p = new URLSearchParams(q.replace(/^\?/, ''));
@@ -83,6 +91,7 @@ describe('toCalendarQuery', () => {
     expect(p.get('date')).toBe('2026-10-05');
     expect(p.get('session')).toBe('abc-123');
     expect(p.get('track')).toBe('Cloud & AI');
+    expect(p.get('format')).toBe('PreRecorded');
     expect(p.get('edition')).toBe('dtf-2026');
   });
 
@@ -96,7 +105,8 @@ describe('toCalendarQuery', () => {
       '?view=week',
       '?view=day&date=2026-10-05',
       '?session=abc-123&track=DevOps',
-      '?view=day&date=2026-10-05&session=abc-123&track=Cloud%20%26%20AI&edition=dtf-2026',
+      '?format=Live',
+      '?view=day&date=2026-10-05&session=abc-123&track=Cloud%20%26%20AI&format=PreRecorded&edition=dtf-2026',
     ]) {
       const state = parseCalendarUrl(search);
       expect(parseCalendarUrl(toCalendarQuery(state))).toEqual(state);
diff --git a/hugo-apps/src/devtoberfest-sessions-calendar/url-state.ts b/hugo-apps/src/devtoberfest-sessions-calendar/url-state.ts
index 6b9d8a9d2..3472174a7 100644
--- a/hugo-apps/src/devtoberfest-sessions-calendar/url-state.ts
+++ b/hugo-apps/src/devtoberfest-sessions-calendar/url-state.ts
@@ -10,6 +10,7 @@
 //   date=YYYY-MM-DD        cursor anchor (viewer-local day for a session link)
 //   session=<id>           opens that session's detail panel
 //   track=<trackName>      track filter (the toolbar filters by name, not id)
+//   format=<value>         broadcasting format filter (Live | PreRecorded)
 //   edition=<editionId>    edition selection
 //
 // Every value is validated; anything unrecognised falls back to null so a
@@ -22,6 +23,7 @@ export interface CalendarUrlState {
   readonly date: string | null;   // YYYY-MM-DD (validated real calendar date)
   readonly session: string | null;
   readonly track: string | null;
+  readonly format: string | null;
   readonly edition: string | null;
 }
 
@@ -30,6 +32,7 @@ export const DEFAULT_URL_STATE: CalendarUrlState = Object.freeze({
   date: null,
   session: null,
   track: null,
+  format: null,
   edition: null,
 });
 
@@ -76,6 +79,7 @@ export function parseCalendarUrl(search: string | URLSearchParams): CalendarUrlS
     date,
     session: nonEmpty(p.get('session')),
     track: nonEmpty(p.get('track')),
+    format: nonEmpty(p.get('format')),
     edition: nonEmpty(p.get('edition')),
   };
 }
@@ -91,6 +95,7 @@ export function toCalendarQuery(state: CalendarUrlState): string {
   if (isValidDate(state.date)) p.set('date', state.date);
   if (state.session) p.set('session', state.session);
   if (state.track) p.set('track', state.track);
+  if (state.format) p.set('format', state.format);
   if (state.edition) p.set('edition', state.edition);
   const s = p.toString();
   return s ? `?${s}` : '';
diff --git a/hugo-apps/src/devtoberfest-sessions-grid/App.vue b/hugo-apps/src/devtoberfest-sessions-grid/App.vue
index 6b6ba809a..feb6fb0f4 100644
--- a/hugo-apps/src/devtoberfest-sessions-grid/App.vue
+++ b/hugo-apps/src/devtoberfest-sessions-grid/App.vue
@@ -2,6 +2,7 @@
 import { ref, computed, onMounted, onBeforeUnmount, watch } from 'vue';
 import { fetchFeed, fetchMyCompletions } from '../devtoberfest-schedule-shared/feed';
 import { mergeCompletion, youtubeThumb, safeHref, sessionMatchesQuery } from '../devtoberfest-schedule-shared/completion';
+import { broadcastingTag, matchesFormat, FORMAT_FILTER_OPTIONS } from '../devtoberfest-schedule-shared/broadcasting';
 import EditionPicker from '../devtoberfest-schedule-shared/EditionPicker.vue';
 import PointsBanner from '../devtoberfest-schedule-shared/PointsBanner.vue';
 import DetailPanel from '../devtoberfest-schedule-shared/DetailPanel.vue';
@@ -23,6 +24,7 @@ const selectedRow = ref<ScheduleRow | null>(null);
 const filterQuery = ref('');
 const filterWeek = ref('');
 const filterTrack = ref('');
+const filterFormat = ref('');
 
 // --- Deep-linking (issue #2030) -------------------------------------------
 // The page URL is the source of truth on first load. We parse it once, apply
@@ -38,6 +40,7 @@ let applied = false;
 if (initialUrl.q) filterQuery.value = initialUrl.q;
 if (initialUrl.week) filterWeek.value = initialUrl.week;
 if (initialUrl.track) filterTrack.value = initialUrl.track;
+if (initialUrl.format) filterFormat.value = initialUrl.format;
 
 async function loadData(edition?: string) {
   loading.value = true;
@@ -93,6 +96,7 @@ const filtered = computed(() => {
   return sessions.value.filter((r) => {
     if (filterWeek.value && r.week !== filterWeek.value) return false;
     if (filterTrack.value && (r as any).trackName !== filterTrack.value) return false;
+    if (!matchesFormat((r as any).broadcastingPreference, filterFormat.value)) return false;
     if (!sessionMatchesQuery(r, filterQuery.value)) return false;
     return true;
   });
@@ -102,6 +106,7 @@ function clearFilters() {
   filterQuery.value = '';
   filterWeek.value = '';
   filterTrack.value = '';
+  filterFormat.value = '';
 }
 
 function onThumbError(ev: Event) {
@@ -118,6 +123,7 @@ function currentUrlState(): SessionsUrlState {
     q: filterQuery.value || null,
     week: filterWeek.value || null,
     track: filterTrack.value || null,
+    format: filterFormat.value || null,
     // Omit edition when it's just the active default — the ?edition param is
     // for explicitly viewing a non-active edition.
     edition: editionId.value && editionId.value !== feed.value?.activeEditionId
@@ -138,6 +144,7 @@ function applyFromUrl(st: SessionsUrlState) {
   filterQuery.value = st.q ?? '';
   filterWeek.value = st.week ?? '';
   filterTrack.value = st.track ?? '';
+  filterFormat.value = st.format ?? '';
   if (st.session) {
     const row = sessions.value.find((r) => r.id === st.session);
     selectedRow.value = row ?? null;
@@ -159,7 +166,7 @@ onMounted(async () => {
 
 onBeforeUnmount(() => window.removeEventListener('popstate', onPopState));
 
-watch([filterQuery, filterWeek, filterTrack, editionId, selectedRow], writeUrl);
+watch([filterQuery, filterWeek, filterTrack, filterFormat, editionId, selectedRow], writeUrl);
 </script>
 
 <template>
@@ -220,8 +227,14 @@ watch([filterQuery, filterWeek, filterTrack, editionId, selectedRow], writeUrl);
             <option v-for="t in trackOptions" :key="t" :value="t">{{ t }}</option>
           </select>
         </label>
+        <label class="sg-field">
+          <span>Format</span>
+          <select v-model="filterFormat" aria-label="Filter by session format">
+            <option v-for="opt in FORMAT_FILTER_OPTIONS" :key="opt.value" :value="opt.value">{{ opt.label }}</option>
+          </select>
+        </label>
         <button
-          v-if="filterQuery || filterWeek || filterTrack"
+          v-if="filterQuery || filterWeek || filterTrack || filterFormat"
           class="sg-btn sg-btn-ghost"
           @click="clearFilters"
         >Clear</button>
@@ -262,6 +275,14 @@ watch([filterQuery, filterWeek, filterTrack, editionId, selectedRow], writeUrl);
           <div class="sg-card-body">
             <!-- badges row -->
             <div class="sg-badges">
+              <span
+                v-if="broadcastingTag((session as any).broadcastingPreference)"
+                class="sg-badge"
+                :class="`sg-badge--${broadcastingTag((session as any).broadcastingPreference)!.modifier}`"
+              >
+                {{ broadcastingTag((session as any).broadcastingPreference)!.icon }}
+                {{ broadcastingTag((session as any).broadcastingPreference)!.label }}
+              </span>
               <span v-if="(session as any).trackName" class="sg-badge sg-badge--track">
                 {{ (session as any).trackName }}
               </span>
@@ -507,6 +528,16 @@ watch([filterQuery, filterWeek, filterTrack, editionId, selectedRow], writeUrl);
   color: var(--sapContent_LabelColor, #6a6d70);
 }
 
+.sg-badge--live {
+  background: var(--sapErrorBackground, #ffebeb);
+  color: var(--sapNegativeColor, #b00020);
+}
+
+.sg-badge--prerecorded {
+  background: var(--sapNeutralBackground, #f5f6f7);
+  color: var(--sapContent_LabelColor, #6a6d70);
+}
+
 .sg-done {
   color: var(--sapPositiveColor, #107e3e);
   font-weight: 700;
diff --git a/hugo-apps/src/devtoberfest-sessions-grid/__tests__/url-state.test.ts b/hugo-apps/src/devtoberfest-sessions-grid/__tests__/url-state.test.ts
index 4c00a1c95..d35ef4bc1 100644
--- a/hugo-apps/src/devtoberfest-sessions-grid/__tests__/url-state.test.ts
+++ b/hugo-apps/src/devtoberfest-sessions-grid/__tests__/url-state.test.ts
@@ -21,11 +21,12 @@ describe('parseSessionsUrl', () => {
   });
 
   it('parses every recognised param (URL-decoded)', () => {
-    const s = parseSessionsUrl('?q=hana%20cloud&week=1&track=Cloud%20%26%20AI&edition=dtf-2026&session=abc-123');
+    const s = parseSessionsUrl('?q=hana%20cloud&week=1&track=Cloud%20%26%20AI&format=Live&edition=dtf-2026&session=abc-123');
     expect(s).toEqual({
       q: 'hana cloud',
       week: '1',
       track: 'Cloud & AI',
+      format: 'Live',
       edition: 'dtf-2026',
       session: 'abc-123',
     });
@@ -67,6 +68,7 @@ describe('toSessionsQuery', () => {
       q: 'hana cloud',
       week: '2',
       track: 'Cloud & AI',
+      format: 'PreRecorded',
       edition: 'dtf-2026',
       session: 'abc-123',
     });
@@ -74,6 +76,7 @@ describe('toSessionsQuery', () => {
     expect(p.get('q')).toBe('hana cloud');
     expect(p.get('week')).toBe('2');
     expect(p.get('track')).toBe('Cloud & AI');
+    expect(p.get('format')).toBe('PreRecorded');
     expect(p.get('edition')).toBe('dtf-2026');
     expect(p.get('session')).toBe('abc-123');
   });
@@ -83,7 +86,8 @@ describe('toSessionsQuery', () => {
       '',
       '?q=cap',
       '?week=1&track=DevOps',
-      '?q=hana%20cloud&week=2&track=Cloud%20%26%20AI&edition=dtf-2026&session=abc-123',
+      '?format=Live',
+      '?q=hana%20cloud&week=2&track=Cloud%20%26%20AI&format=PreRecorded&edition=dtf-2026&session=abc-123',
       '?session=xyz',
     ]) {
       const state = parseSessionsUrl(search);
diff --git a/hugo-apps/src/devtoberfest-sessions-grid/url-state.ts b/hugo-apps/src/devtoberfest-sessions-grid/url-state.ts
index e757495e5..03629b202 100644
--- a/hugo-apps/src/devtoberfest-sessions-grid/url-state.ts
+++ b/hugo-apps/src/devtoberfest-sessions-grid/url-state.ts
@@ -9,6 +9,7 @@
 //   q=<text>        free-text search (title, abstract, speaker, bio…)
 //   week=<week>     week filter (matches ScheduleRow.week)
 //   track=<name>    track filter (matches trackName — by name, not id)
+//   format=<value>  broadcasting format filter (Live | PreRecorded)
 //   edition=<id>    edition selection
 //   session=<id>    opens that session's detail panel
 //
@@ -19,6 +20,7 @@ export interface SessionsUrlState {
   readonly q: string | null;
   readonly week: string | null;
   readonly track: string | null;
+  readonly format: string | null;
   readonly edition: string | null;
   readonly session: string | null;
 }
@@ -27,6 +29,7 @@ export const DEFAULT_URL_STATE: SessionsUrlState = Object.freeze({
   q: null,
   week: null,
   track: null,
+  format: null,
   edition: null,
   session: null,
 });
@@ -48,6 +51,7 @@ export function parseSessionsUrl(search: string | URLSearchParams): SessionsUrlS
     q: nonEmpty(p.get('q')),
     week: nonEmpty(p.get('week')),
     track: nonEmpty(p.get('track')),
+    format: nonEmpty(p.get('format')),
     edition: nonEmpty(p.get('edition')),
     session: nonEmpty(p.get('session')),
   };
@@ -63,6 +67,7 @@ export function toSessionsQuery(state: SessionsUrlState): string {
   if (nonEmpty(state.q)) p.set('q', state.q!);
   if (nonEmpty(state.week)) p.set('week', state.week!);
   if (nonEmpty(state.track)) p.set('track', state.track!);
+  if (nonEmpty(state.format)) p.set('format', state.format!);
   if (nonEmpty(state.edition)) p.set('edition', state.edition!);
   if (nonEmpty(state.session)) p.set('session', state.session!);
   const s = p.toString();
diff --git a/hugo-apps/src/topics-map/App.test.ts b/hugo-apps/src/topics-map/App.test.ts
deleted file mode 100644
index f6431827b..000000000
--- a/hugo-apps/src/topics-map/App.test.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-// @vitest-environment happy-dom
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { mount } from '@vue/test-utils';
-import App from './App.vue';
-
-// Stub ClusterMap.vue so vite never resolves sigma/graphology/fa2 at transform
-// time. The brief says App.test.ts must exercise "fetch + data flow WITHOUT a
-// real Sigma render" — stubs are the correct pattern here.
-vi.mock('./ClusterMap.vue', () => ({
-  default: {
-    name: 'ClusterMapStub',
-    props: ['nodes', 'edges', 'focusCluster'],
-    template: '<div class="cluster-map-stub" />',
-  },
-}));
-
-describe('topics-map App', () => {
-  beforeEach(() => {
-    globalThis.fetch = vi.fn().mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        nodes: [{ id: 'c:hana', slug: 'hana', label: 'HANA', size: 5, type: 'cluster' }],
-        edges: [],
-      }),
-    } as any);
-  });
-
-  it('fetches clusters-data on mount without throwing', async () => {
-    const wrapper = mount(App, { props: { focusCluster: '' } });
-    await new Promise((r) => setTimeout(r, 0));
-    expect(globalThis.fetch).toHaveBeenCalledWith(expect.stringContaining('/graph/clusters-data'));
-    expect(wrapper.exists()).toBe(true);
-  });
-
-  it('degrades quietly when fetch fails — island container not rendered', async () => {
-    globalThis.fetch = vi.fn().mockRejectedValue(new Error('down'));
-    const wrapper = mount(App, { props: { focusCluster: '' } });
-    await new Promise((r) => setTimeout(r, 0));
-    // The v-if="!failed && graphData" gate must suppress the container on error.
-    expect(wrapper.find('.topics-map-island').exists()).toBe(false);
-    expect(wrapper.exists()).toBe(true); // component itself still mounted, no throw
-  });
-});
diff --git a/hugo-apps/src/topics-map/App.vue b/hugo-apps/src/topics-map/App.vue
deleted file mode 100644
index 6f7cd79b4..000000000
--- a/hugo-apps/src/topics-map/App.vue
+++ /dev/null
@@ -1,65 +0,0 @@
-<script setup lang="ts">
-/**
- * hugo-apps/src/topics-map/App.vue
- *
- * Orchestrator for the Topics Cluster Map island.
- * Fetches /graph/clusters-data, passes the super-graph to ClusterMap.vue.
- * On fetch failure the container is hidden (progressive enhancement — the
- * baked gallery above still renders).
- */
-import { ref, onMounted } from 'vue';
-import ClusterMap from './ClusterMap.vue';
-
-const props = defineProps<{
-  focusCluster: string;
-}>();
-
-interface ClusterNode {
-  id: string;
-  type: 'cluster';
-  slug: string;
-  label: string;
-  size: number;
-}
-
-interface ClusterEdge {
-  s: string;
-  o: string;
-  weight: number;
-}
-
-interface ClustersData {
-  nodes: ClusterNode[];
-  edges: ClusterEdge[];
-  generatedAt?: string;
-}
-
-const graphData = ref<ClustersData | null>(null);
-const failed = ref(false);
-
-onMounted(async () => {
-  try {
-    const res = await fetch('/graph/clusters-data');
-    if (!res.ok) {
-      failed.value = true;
-      return;
-    }
-    const data: ClustersData = await res.json();
-    graphData.value = data;
-  } catch {
-    // Network error — degrade silently; the baked gallery stays visible.
-    failed.value = true;
-  }
-});
-</script>
-
-<template>
-  <!-- Hide entire island on fetch failure; baked gallery above remains. -->
-  <div v-if="!failed && graphData" class="topics-map-island">
-    <ClusterMap
-      :nodes="graphData.nodes"
-      :edges="graphData.edges"
-      :focus-cluster="focusCluster"
-    />
-  </div>
-</template>
diff --git a/hugo-apps/src/topics-map/ClusterMap.vue b/hugo-apps/src/topics-map/ClusterMap.vue
deleted file mode 100644
index 6fd8fde27..000000000
--- a/hugo-apps/src/topics-map/ClusterMap.vue
+++ /dev/null
@@ -1,278 +0,0 @@
-<script setup lang="ts">
-/**
- * hugo-apps/src/topics-map/ClusterMap.vue
- *
- * Sigma.js 3 graph render for the Topics Cluster Map island.
- *
- * Super-graph: nodes are cluster super-nodes (type='cluster'), sized by
- * `size`, colored by a stable hue derived from the slug. Edge thickness
- * proportional to weight.
- *
- * Click a super-node → fetch /graph/clusters-data?cluster=<slug>,
- * add its concept child-nodes, dim all other clusters (expand-in-place).
- *
- * "See full graph →" links to /explore/?focus=<firstConceptSlug> (Task 10).
- *
- * Progressive enhancement guard: onMounted checks container dimensions.
- * If the container has zero size (jsdom in tests, or an invisible section)
- * Sigma init is skipped entirely — no WebGL context errors.
- */
-import { ref, watch, onMounted, onBeforeUnmount } from 'vue';
-import { MultiDirectedGraph } from 'graphology';
-import Sigma from 'sigma';
-import forceAtlas2 from 'graphology-layout-forceatlas2';
-
-interface ClusterNode {
-  id: string;
-  type: 'cluster';
-  slug: string;
-  label: string;
-  size: number;
-}
-
-interface ClusterEdge {
-  s: string;
-  o: string;
-  weight: number;
-}
-
-interface ConceptNode {
-  id: string;
-  type: 'concept';
-  slug: string;
-  label: string;
-}
-
-const props = defineProps<{
-  nodes: ClusterNode[];
-  edges: ClusterEdge[];
-  focusCluster: string;
-}>();
-
-const container = ref<HTMLDivElement | null>(null);
-
-let renderer: Sigma | null = null;
-let graph: MultiDirectedGraph | null = null;
-
-// Track which clusters have been expanded (concepts loaded).
-const expandedClusters = new Set<string>();
-// Track the currently highlighted/expanded cluster slug for UI.
-const activeCluster = ref<string>('');
-// First concept slug of the active cluster (for "See full graph →").
-const firstConceptSlug = ref<string>('');
-
-// --- Stable hue from slug (djb2 hash) ---
-function slugToHue(slug: string): number {
-  let hash = 5381;
-  for (let i = 0; i < slug.length; i++) {
-    hash = ((hash << 5) + hash) ^ slug.charCodeAt(i);
-    hash = hash >>> 0; // keep unsigned 32-bit
-  }
-  return hash % 360;
-}
-
-function clusterColor(slug: string): string {
-  const hue = slugToHue(slug);
-  return `hsl(${hue}, 60%, 45%)`;
-}
-
-const CONCEPT_COLOR = '#107e3e';
-const DIMMED_COLOR = '#d0d0d0';
-const DEFAULT_NODE_SIZE = 10;
-
-// Build the initial super-graph.
-function buildGraph(): void {
-  if (!container.value) return;
-
-  // Zero-size guard: jsdom has no layout engine, so offsetWidth/Height === 0.
-  // Sigma requires a sized container for WebGL canvas creation. Skip init
-  // gracefully so unit tests (which mount in jsdom) never hit a WebGL error.
-  if (container.value.offsetWidth === 0 && container.value.offsetHeight === 0) {
-    return;
-  }
-
-  renderer?.kill();
-  renderer = null;
-  graph = null;
-  expandedClusters.clear();
-  activeCluster.value = '';
-  firstConceptSlug.value = '';
-
-  graph = new MultiDirectedGraph();
-
-  for (const n of props.nodes) {
-    graph.addNode(n.id, {
-      x: Math.random(),
-      y: Math.random(),
-      size: Math.max(4, n.size),
-      label: n.label,
-      color: clusterColor(n.slug),
-      slug: n.slug,
-      nodeType: 'cluster',
-    });
-  }
-
-  for (const e of props.edges) {
-    const key = `${e.s}--${e.o}`;
-    if (!graph.hasEdge(key)) {
-      graph.addEdgeWithKey(key, e.s, e.o, {
-        size: Math.max(1, Math.round(e.weight * 3)),
-        color: '#cccccc',
-      });
-    }
-  }
-
-  forceAtlas2.assign(graph, { iterations: 50, settings: { gravity: 1, scalingRatio: 10 } });
-
-  renderer = new Sigma(graph, container.value, {
-    minCameraRatio: 0.05,
-    maxCameraRatio: 5,
-    // Force built-in circle program for every node regardless of stored nodeType.
-    nodeReducer: (_node, data) => ({ ...data, type: 'circle' }),
-    // Force built-in line program for every edge regardless of stored type.
-    edgeReducer: (_edge, data) => ({ ...data, type: 'line' }),
-  });
-
-  renderer.on('clickNode', ({ node }) => {
-    if (!graph) return;
-    const attrs = graph.getNodeAttributes(node);
-    if (attrs.nodeType === 'cluster') {
-      expandCluster(attrs.slug as string, node);
-    }
-  });
-
-  // Auto-expand focus cluster (cluster-detail mini-map).
-  if (props.focusCluster) {
-    const focusNodeId = `c:${props.focusCluster}`;
-    if (graph.hasNode(focusNodeId)) {
-      expandCluster(props.focusCluster, focusNodeId);
-    }
-  }
-}
-
-// Expand a cluster: fetch concept children, add to graph, dim others.
-async function expandCluster(slug: string, nodeId: string): Promise<void> {
-  if (!graph) return;
-
-  activeCluster.value = slug;
-  firstConceptSlug.value = '';
-
-  // Dim all other cluster nodes.
-  graph.forEachNode((id: string, attrs: any) => {
-    if (id !== nodeId && attrs.nodeType === 'cluster') {
-      graph!.setNodeAttribute(id, 'color', DIMMED_COLOR);
-    }
-  });
-
-  // If already expanded, just re-highlight and refresh.
-  if (expandedClusters.has(slug)) {
-    // Re-show any concept children belonging to this cluster.
-    graph.forEachNode((id: string, attrs: any) => {
-      if (attrs.parentCluster === slug) {
-        graph!.setNodeAttribute(id, 'color', CONCEPT_COLOR);
-        firstConceptSlug.value ||= attrs.slug as string;
-      }
-    });
-    renderer?.refresh?.();
-    return;
-  }
-
-  try {
-    const res = await fetch(`/graph/clusters-data?cluster=${encodeURIComponent(slug)}`);
-    if (!res.ok) return;
-    const data: { nodes: ConceptNode[]; edges: unknown[] } = await res.json();
-
-    // Position child-nodes near the parent cluster node.
-    const parentX: number = graph.getNodeAttribute(nodeId, 'x') as number ?? 0;
-    const parentY: number = graph.getNodeAttribute(nodeId, 'y') as number ?? 0;
-
-    for (const n of data.nodes) {
-      if (!graph.hasNode(n.id)) {
-        const angle = Math.random() * 2 * Math.PI;
-        const r = 0.1 + Math.random() * 0.15;
-        graph.addNode(n.id, {
-          x: parentX + r * Math.cos(angle),
-          y: parentY + r * Math.sin(angle),
-          size: 4,
-          label: n.label,
-          color: CONCEPT_COLOR,
-          slug: n.slug,
-          nodeType: 'concept',
-          parentCluster: slug,
-        });
-        if (!firstConceptSlug.value) {
-          firstConceptSlug.value = n.slug;
-        }
-      }
-    }
-
-    expandedClusters.add(slug);
-    renderer?.refresh?.();
-  } catch {
-    // Fetch failed — leave graph as-is.
-  }
-}
-
-onMounted(() => {
-  buildGraph();
-});
-
-// Rebuild graph when node/edge props change (parent re-fetch).
-watch([() => props.nodes, () => props.edges], () => {
-  buildGraph();
-});
-
-onBeforeUnmount(() => {
-  renderer?.kill();
-  renderer = null;
-  graph = null;
-});
-</script>
-
-<template>
-  <div class="topics-cluster-map">
-    <div ref="container" class="topics-cluster-map__canvas" />
-    <div v-if="activeCluster && firstConceptSlug" class="topics-cluster-map__actions">
-      <a
-        class="topics-cluster-map__full-graph-link"
-        :href="`/explore/?focus=${encodeURIComponent(firstConceptSlug)}`"
-      >
-        See full graph &rarr;
-      </a>
-    </div>
-  </div>
-</template>
-
-<style scoped>
-.topics-cluster-map {
-  position: relative;
-  width: 100%;
-  height: 420px;
-}
-
-.topics-cluster-map__canvas {
-  width: 100%;
-  height: 100%;
-}
-
-.topics-cluster-map__actions {
-  position: absolute;
-  bottom: 12px;
-  right: 12px;
-  z-index: 10;
-}
-
-.topics-cluster-map__full-graph-link {
-  display: inline-block;
-  padding: 6px 14px;
-  background: #0a6ed1;
-  color: #fff;
-  border-radius: 4px;
-  text-decoration: none;
-  font-size: 0.875rem;
-}
-
-.topics-cluster-map__full-graph-link:hover {
-  background: #0854a0;
-}
-</style>
diff --git a/hugo-apps/src/topics-map/main.ts b/hugo-apps/src/topics-map/main.ts
deleted file mode 100644
index d4e09aef5..000000000
--- a/hugo-apps/src/topics-map/main.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-// hugo-apps/src/topics-map/main.ts
-//
-// Mount-on-discovery for the Topics Cluster Map island.
-// Vite emits this file as hugo/static/js/topics-map.js (configured in
-// hugo-apps/vite.config.ts). The topics layouts emit mount points:
-//
-//   <section data-vue-island="topics-map">  (list.html — full gallery map)
-//   <div data-vue-island="topics-map" data-focus-cluster="<slug>">  (single.html — mini-map)
-//
-// Optional data-focus-cluster attribute causes the island to auto-expand
-// the named cluster on mount (used by the cluster-detail mini-map).
-
-import { createApp } from 'vue';
-import App from './App.vue';
-
-document.querySelectorAll<HTMLElement>('[data-vue-island="topics-map"]').forEach((el) => {
-  createApp(App, { focusCluster: el.getAttribute('data-focus-cluster') || '' }).mount(el);
-});
diff --git a/hugo-apps/src/topics-tree/main.ts b/hugo-apps/src/topics-tree/main.ts
new file mode 100644
index 000000000..059ce5f50
--- /dev/null
+++ b/hugo-apps/src/topics-tree/main.ts
@@ -0,0 +1,70 @@
+// hugo-apps/src/topics-tree/main.ts
+//
+// Progressive enhancement over the server-rendered <details>/<ul> tree that
+// renderTopicListBody() (srv/lib/topic-list-page.js) emits under
+// <article id="topics-tree-root">.
+// Adds: type-ahead filter and hash deep-link (#topic=<slug>).
+// Inert until JS loads; the server markup is fully functional without it.
+
+function boot(): void {
+  const root = document.getElementById('topics-tree-root');
+  const input = document.getElementById('topics-filter-input') as HTMLInputElement | null;
+  if (!root || !input) return;
+
+  const allDetails = Array.from(root.querySelectorAll<HTMLDetailsElement>('details'));
+  // Capture the initial open state so we can restore on query clear.
+  const initialOpen = new Map(allDetails.map(d => [d, d.open]));
+
+  function applyFilter(q: string): void {
+    if (!q) {
+      // Restore all li visibility and original details open states.
+      root.querySelectorAll<HTMLLIElement>('li').forEach(li => { li.style.display = ''; });
+      allDetails.forEach(d => { d.open = initialOpen.get(d) ?? false; });
+      return;
+    }
+
+    // Hide every li and close every details; then show matching leaves
+    // and walk up to reveal their ancestors.
+    root.querySelectorAll<HTMLLIElement>('li').forEach(li => { li.style.display = 'none'; });
+    allDetails.forEach(d => { d.open = false; });
+
+    root.querySelectorAll<HTMLLIElement>('li').forEach(li => {
+      // Only process leaf nodes (those without a direct nested <details>).
+      if (li.querySelector(':scope > details')) return;
+      const text = (li.textContent ?? '').toLowerCase();
+      if (!text.includes(q)) return;
+      // Match: reveal this leaf and walk up to show all ancestor li + open ancestor details.
+      li.style.display = '';
+      let el: Element | null = li.parentElement;
+      while (el && el !== root) {
+        if (el.tagName === 'LI') (el as HTMLElement).style.display = '';
+        if (el.tagName === 'DETAILS') (el as HTMLDetailsElement).open = true;
+        el = el.parentElement;
+      }
+    });
+  }
+
+  input.addEventListener('input', () => {
+    applyFilter(input.value.trim().toLowerCase());
+  });
+
+  // Deep-link: #topic=<slug> opens the matching node's ancestor details + scrolls into view.
+  const m = location.hash.match(/topic=([a-zA-Z0-9-]+)/);
+  if (m) {
+    const link = root.querySelector<HTMLElement>(`a[href="/topics/${m[1]}/"]`);
+    if (link) {
+      let d: HTMLDetailsElement | null = link.closest('details');
+      while (d) {
+        d.open = true;
+        d = d.parentElement?.closest<HTMLDetailsElement>('details') ?? null;
+      }
+      link.scrollIntoView({ block: 'center' });
+    }
+  }
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', boot);
+} else {
+  boot();
+}
diff --git a/hugo-apps/vite.config.ts b/hugo-apps/vite.config.ts
index 22b08a76d..4d95ce18f 100644
--- a/hugo-apps/vite.config.ts
+++ b/hugo-apps/vite.config.ts
@@ -12,7 +12,6 @@ const MAX_ADVOCATES_GZIP = 30 * 1024;
 const MAX_PUZZLE_GZIP = 30 * 1024;
 const MAX_ADVOCATE_PROFILE_GZIP = 25 * 1024;
 const MAX_RELATED_GRAPH_GZIP = 12 * 1024;
-const MAX_TOPICS_MAP_GZIP = 150 * 1024;
 const MAX_ALERTS_GZIP = 12 * 1024;
 const MAX_HOMEPAGE_EXPLAINERS_GZIP = 12 * 1024;
 const MAX_HOMEPAGE_PERSONALIZER_GZIP = 12 * 1024;
@@ -216,24 +215,6 @@ function relatedGraphBudget() {
   };
 }
 
-function topicsMapBudget() {
-  return {
-    name: 'topics-map-budget',
-    generateBundle(_opts: unknown, bundle: Record<string, any>) {
-      const chunk = Object.values(bundle).find((c: any) => c.type === 'chunk' && c.name === 'topics-map');
-      if (!chunk) return;
-      const gz = gzipSync(chunk.code).length;
-      if (gz > MAX_TOPICS_MAP_GZIP) {
-        // @ts-ignore — Rollup plugin context
-        this.error(`topics-map.js is ${gz} bytes gzipped (> ${MAX_TOPICS_MAP_GZIP}). Move code to a lazy chunk.`);
-      } else {
-        // @ts-ignore
-        this.warn(`topics-map.js: ${gz} bytes gzipped (budget ${MAX_TOPICS_MAP_GZIP}).`);
-      }
-    }
-  };
-}
-
 function petoberfestBudget() {
   return {
     name: 'petoberfest-budget',
@@ -253,7 +234,7 @@ function petoberfestBudget() {
 }
 
 export default defineConfig({
-  plugins: [vue(), cssInjectedByJsPlugin({ relativeCSSInjection: true }), tutorialPrefsBudget(), codeCheckBudget(), validationBudget(), tutorialBranchesBudget(), advocatesBudget(), puzzleBudget(), relatedGraphBudget(), alertsBudget(), homepageExplainersBudget(), advocateProfileBudget(), homepagePersonalizerBudget(), petoberfestBudget(), topicsMapBudget()],
+  plugins: [vue(), cssInjectedByJsPlugin({ relativeCSSInjection: true }), tutorialPrefsBudget(), codeCheckBudget(), validationBudget(), tutorialBranchesBudget(), advocatesBudget(), puzzleBudget(), relatedGraphBudget(), alertsBudget(), homepageExplainersBudget(), advocateProfileBudget(), homepagePersonalizerBudget(), petoberfestBudget()],
   // Approuter serves these bundles at /js/. Without `base`, Vite emits
   // dynamic-import paths as `./chunks/x.js` which the browser resolves
   // against the *document URL* (e.g. `/` → `/chunks/x.js` → 404). Setting
@@ -314,7 +295,7 @@ export default defineConfig({
         'homepage-bands': resolve(__dirname, 'src/homepage-bands/index.ts'),
         'kg-stats-counter': resolve(__dirname, 'src/kg-stats-counter/main.ts'),
         'concepts-filter': resolve(__dirname, 'src/concepts-filter/main.ts'),
-        'topics-map': resolve(__dirname, 'src/topics-map/main.ts'),
+        'topics-tree': resolve(__dirname, 'src/topics-tree/main.ts'),
         'homepage-explainers': resolve(__dirname, 'src/homepage-explainers/index.ts'),
         'homepage-personalizer': resolve(__dirname, 'src/homepage-personalizer/index.ts'),
         'featured-topics-carousel': resolve(__dirname, 'src/featured-topics-carousel/main.ts'),
diff --git a/hugo/assets/css/sap-fundamental.css b/hugo/assets/css/sap-fundamental.css
index 4f5f183a1..9b5a06c24 100644
--- a/hugo/assets/css/sap-fundamental.css
+++ b/hugo/assets/css/sap-fundamental.css
@@ -4113,6 +4113,16 @@ blockquote {
   font-size: 0.6875rem;
   font-weight: 600;
 }
+/* #2112 — clickable Overview tags: deep-link parity with the header chips */
+a.tutorial-tag--link {
+  text-decoration: none;
+  cursor: pointer;
+}
+a.tutorial-tag--link:hover,
+a.tutorial-tag--link:focus-visible {
+  background: var(--sapBrandColor, #0070f2);
+  color: var(--sapButton_Emphasized_TextColor, #fff);
+}
 /* Step progress bar */
 #progress-bar {
   display: flex;
diff --git a/hugo/assets/css/sap-fundamental.src.css b/hugo/assets/css/sap-fundamental.src.css
index a720a5729..19b0c98d8 100644
--- a/hugo/assets/css/sap-fundamental.src.css
+++ b/hugo/assets/css/sap-fundamental.src.css
@@ -891,6 +891,18 @@ blockquote {
   font-weight: 600;
 }
 
+/* #2112 — clickable Overview tags: deep-link parity with the header chips */
+a.tutorial-tag--link {
+  text-decoration: none;
+  cursor: pointer;
+}
+
+a.tutorial-tag--link:hover,
+a.tutorial-tag--link:focus-visible {
+  background: var(--sapBrandColor, #0070f2);
+  color: var(--sapButton_Emphasized_TextColor, #fff);
+}
+
 /* Step progress bar */
 #progress-bar {
   display: flex;
diff --git a/hugo/assets/css/topics.css b/hugo/assets/css/topics.css
index 88fedb2d8..27693b25c 100644
--- a/hugo/assets/css/topics.css
+++ b/hugo/assets/css/topics.css
@@ -339,3 +339,112 @@
   margin-top: 2rem;
   min-height: 0;
 }
+
+/* ========================================================
+   Topic detail page (srv/lib/topic-detail-render.js)
+   .topic-* classes (singular, no 's') — distinct from the
+   retired .topics-detail/* cluster-detail classes above.
+   ======================================================== */
+.topic-detail {
+  max-width: 800px;
+  margin: 0 auto;
+  padding: 0 1rem 3rem;
+}
+
+/* Breadcrumb */
+.topic-breadcrumb {
+  padding: 1.25rem 0 0;
+}
+.topic-breadcrumb__list {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.5rem;
+  list-style: none;
+  padding: 0;
+  margin: 0;
+  font-size: 0.85rem;
+  color: var(--sapContent_LabelColor, #6a6d70);
+}
+.topic-breadcrumb__list li:not(:last-child)::after {
+  content: '/';
+  margin-left: 0.5rem;
+  color: var(--sapContent_LabelColor, #9ea0a2);
+}
+.topic-breadcrumb__list a {
+  color: var(--sapLinkColor, #0064d9);
+  text-decoration: none;
+}
+.topic-breadcrumb__list a:hover { text-decoration: underline; }
+
+/* Header */
+.topic-detail__header {
+  padding: 1.5rem 0 1rem;
+}
+.topic-detail__title {
+  font-size: 1.75rem;
+  font-weight: 700;
+  color: var(--sapTextColor, #32363a);
+  margin: 0 0 0.5rem;
+}
+.topic-detail__facet {
+  font-size: 0.875rem;
+  color: var(--sapContent_LabelColor, #6a6d70);
+  margin: 0;
+  text-transform: capitalize;
+}
+
+/* Sections (tutorials, concepts, related) */
+.topic-tutorials,
+.topic-concepts,
+.topic-related {
+  margin: 1.75rem 0;
+  padding-top: 1.25rem;
+  border-top: 1px solid var(--sapContent_ForegroundBorderColor, #e5e5e5);
+}
+.topic-tutorials h2,
+.topic-concepts h2,
+.topic-related h2 {
+  font-size: 1.15rem;
+  font-weight: 600;
+  color: var(--sapTextColor, #32363a);
+  margin: 0 0 0.75rem;
+}
+.topic-tutorials__list,
+.topic-concepts__list,
+.topic-related__list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+.topic-tutorials__item,
+.topic-concepts__item,
+.topic-related__item {
+  padding: 0.3rem 0;
+}
+.topic-tutorials__link,
+.topic-concepts__item a,
+.topic-related__item a {
+  color: var(--sapLinkColor, #0064d9);
+  text-decoration: none;
+}
+.topic-tutorials__link:hover,
+.topic-concepts__item a:hover,
+.topic-related__item a:hover { text-decoration: underline; }
+.topic-tutorials__new {
+  font-size: 0.7rem;
+  font-weight: 600;
+  color: var(--sapPositiveTextColor, #107e3e);
+  background: var(--sapSuccessBackground, #f1fdf6);
+  padding: 0.1rem 0.4rem;
+  border-radius: 3px;
+  margin-left: 0.35rem;
+  vertical-align: middle;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+.topic-tutorials__level {
+  font-size: 0.78rem;
+  color: var(--sapContent_LabelColor, #6a6d70);
+  margin-left: 0.35rem;
+}
diff --git a/hugo/content/topics/_index.md b/hugo/content/topics/_index.md
deleted file mode 100644
index 022c81fad..000000000
--- a/hugo/content/topics/_index.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "Topics"
-type: topics
-layout: list
-description: "Explore SAP developer topics. Browse clusters of related concepts and follow a suggested learning path."
----
diff --git a/hugo/content/topics/btp-basics.md b/hugo/content/topics/btp-basics.md
deleted file mode 100644
index 2474fcad3..000000000
--- a/hugo/content/topics/btp-basics.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "BTP Basics"
-type: topics
-layout: single
-cluster: "btp-basics"
----
diff --git a/hugo/content/topics/cap-fundamentals.md b/hugo/content/topics/cap-fundamentals.md
deleted file mode 100644
index fbab98f68..000000000
--- a/hugo/content/topics/cap-fundamentals.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-title: "CAP Fundamentals"
-type: topics
-layout: single
-cluster: "cap-fundamentals"
----
diff --git a/hugo/data/topics_gallery.json b/hugo/data/topics_gallery.json
deleted file mode 100644
index 0a9745758..000000000
--- a/hugo/data/topics_gallery.json
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  "gallery": [
-    {
-      "slug": "cap-fundamentals",
-      "label": "CAP Fundamentals",
-      "rationale": "Core concepts for building cloud-native apps with SAP CAP — service definitions, data models, event handlers.",
-      "memberCount": 12,
-      "tutorialCount": 8,
-      "topConcepts": [
-        { "slug": "core-data-services-cds", "name": "CDS Data Model" },
-        { "slug": "cap-application-development", "name": "CAP Service" },
-        { "slug": "odata-v4-service", "name": "OData V4" },
-        { "slug": "cap-for-nodejs", "name": "Node.js Runtime" }
-      ]
-    },
-    {
-      "slug": "btp-basics",
-      "label": "BTP Basics",
-      "rationale": "Getting started with SAP Business Technology Platform — subaccounts, runtimes, and service bindings.",
-      "memberCount": 9,
-      "tutorialCount": 6,
-      "topConcepts": [
-        { "slug": "btp-account-model", "name": "Subaccount" },
-        { "slug": "cloud-foundry-account-model", "name": "Cloud Foundry" },
-        { "slug": "cf-service-bindings", "name": "Service Binding" }
-      ]
-    }
-  ],
-  "clusters": {
-    "cap-fundamentals": {
-      "slug": "cap-fundamentals",
-      "label": "CAP Fundamentals",
-      "rationale": "Core concepts for building cloud-native apps with SAP CAP — service definitions, data models, event handlers.",
-      "memberCount": 12,
-      "tutorialCount": 8,
-      "orderMode": "path",
-      "concepts": [
-        { "slug": "core-data-services-cds", "name": "CDS Data Model" },
-        { "slug": "cap-application-development", "name": "CAP Service" },
-        { "slug": "odata-v4-service", "name": "OData V4" },
-        { "slug": "cap-for-nodejs", "name": "Node.js Runtime" },
-        { "slug": "cds-annotations", "name": "CDS Annotations" }
-      ],
-      "peers": [
-        { "slug": "btp-basics", "label": "BTP Basics", "weight": 0.72 }
-      ]
-    },
-    "btp-basics": {
-      "slug": "btp-basics",
-      "label": "BTP Basics",
-      "rationale": "Getting started with SAP Business Technology Platform — subaccounts, runtimes, and service bindings.",
-      "memberCount": 9,
-      "tutorialCount": 6,
-      "orderMode": "ranked",
-      "concepts": [
-        { "slug": "btp-account-model", "name": "Subaccount" },
-        { "slug": "cloud-foundry-account-model", "name": "Cloud Foundry" },
-        { "slug": "cf-service-bindings", "name": "Service Binding" },
-        { "slug": "xsuaa-authentication", "name": "XSUAA" }
-      ],
-      "peers": [
-        { "slug": "cap-fundamentals", "label": "CAP Fundamentals", "weight": 0.72 }
-      ]
-    }
-  },
-  "buildAt": "2026-08-09T15:00:00.000Z",
-  "error": null
-}
diff --git a/hugo/data/whats_new.json b/hugo/data/whats_new.json
index f7c727a5e..197cd7191 100644
--- a/hugo/data/whats_new.json
+++ b/hugo/data/whats_new.json
@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-08-28T20:07:37.161Z",
+  "generatedAt": "2026-09-03T01:27:50.171Z",
   "repos": [
     {
       "key": "tutorials-ims",
@@ -8,6 +8,357 @@
     }
   ],
   "entries": [
+    {
+      "id": "tutorials-ims#2117",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2117,
+      "title": "fix(topics): nest /topics/ tree by parsing real titlePath separators",
+      "summary": "The Topics browser now nests into proper drill-in folders instead of showing every tag as a single flat entry.",
+      "category": "Fix",
+      "mergedAt": "2026-09-02T16:47:28Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2117"
+    },
+    {
+      "id": "tutorials-ims#2116",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2116,
+      "title": "feat(devtoberfest): Live vs Prerecorded session tag + format filter (#2110)",
+      "summary": "Devtoberfest sessions now carry a Live vs Prerecorded badge, with a new Format filter across the grid, calendar, and schedule views.",
+      "category": "Feature",
+      "mergedAt": "2026-09-02T16:30:44Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2116"
+    },
+    {
+      "id": "tutorials-ims#2115",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2115,
+      "title": "fix(tutorial): make Overview tags clickable (#2112)",
+      "summary": "Tags in a tutorial's Overview section are now clickable links to browse related tutorials, matching the header chips.",
+      "category": "Fix",
+      "mergedAt": "2026-09-02T16:26:08Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2115"
+    },
+    {
+      "id": "tutorials-ims#2114",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2114,
+      "title": "fix(admin): stop prompting non-SuperAdmin for publish rights on description edits (#2111)",
+      "summary": "Authors and admins can again save a group's description or title edit without hitting a false 'SuperAdmin only' publish-rights error.",
+      "category": "Fix",
+      "mergedAt": "2026-09-02T16:09:53Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2114"
+    },
+    {
+      "id": "tutorials-ims#2109",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2109,
+      "title": "feat(cross-container): ADVOCATE_VALUE_HELP_V1 view for planner Session.host (#2102)",
+      "summary": "The active SAP Developer Advocate roster is now shared as an authoritative value-help source, letting the Devtoberfest planner pick session hosts from the real list.",
+      "category": "Feature",
+      "mergedAt": "2026-09-02T12:15:09Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2109"
+    },
+    {
+      "id": "tutorials-ims#2108",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2108,
+      "title": "fix(ci): allowlist /content/topics* in srv-qa route-drift guard",
+      "summary": "Build-guard update so the new Topics content routes pass continuous integration.",
+      "category": "Maintenance",
+      "mergedAt": "2026-09-02T11:41:19Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2108"
+    },
+    {
+      "id": "tutorials-ims#2107",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2107,
+      "title": "feat(devtoberfest): schedule-consistency check across planner + external assets (#2103)",
+      "summary": "A new admin check flags Devtoberfest sessions whose planner time disagrees with their YouTube livestream or community-event schedule.",
+      "category": "Feature",
+      "mergedAt": "2026-09-02T11:23:34Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2107"
+    },
+    {
+      "id": "tutorials-ims#2106",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2106,
+      "title": "fix(topics): URL-safe topic slugs so /topics/<slug> serves (#2099 follow-up)",
+      "summary": "Topic detail pages now resolve correctly — topic slugs are made URL-safe so /topics/<slug> no longer returns 404.",
+      "category": "Fix",
+      "mergedAt": "2026-09-02T11:09:44Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2106"
+    },
+    {
+      "id": "tutorials-ims#2100",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2100,
+      "title": "fix(approuter): /search 301 via middleware — unblock DEV approuter boot",
+      "summary": "Restored the site frontend after a bad redirect setting; the /search shortcut now redirects reliably.",
+      "category": "Fix",
+      "mergedAt": "2026-09-02T00:43:35Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2100"
+    },
+    {
+      "id": "tutorials-ims#2099",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2099,
+      "title": "feat(topics): tag-tree topics — CAP-served index + detail, concept enrichment, search fix",
+      "summary": "Rebuilt the Topics area with a browsable tag tree, per-topic detail pages enriched with related concepts, and a smarter search redirect.",
+      "category": "Feature",
+      "mergedAt": "2026-09-01T22:02:12Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2099"
+    },
+    {
+      "id": "tutorials-ims#2098",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2098,
+      "title": "fix(#2097): scope QA notify workflow to default branch",
+      "summary": "The QA content-rebuild automation no longer misfires when work is pushed to non-default branches.",
+      "category": "Maintenance",
+      "mergedAt": "2026-09-01T20:10:29Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2098"
+    },
+    {
+      "id": "tutorials-ims#2096",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2096,
+      "title": "feat(admin-ui): make Tutorials OP facets readable (concepts/community/images)",
+      "summary": "The admin Tutorials page now shows readable concept names, community descriptions, and image links instead of raw IDs.",
+      "category": "Feature",
+      "mergedAt": "2026-09-01T18:39:29Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2096"
+    },
+    {
+      "id": "tutorials-ims#2095",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2095,
+      "title": "fix(categories): resolve namespaced entities for HANA backfill + seed classifier descriptions",
+      "summary": "Fixed the Categories facet staying empty by resolving entities correctly against SAP HANA and seeding classifier descriptions.",
+      "category": "Fix",
+      "mergedAt": "2026-09-01T18:39:11Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2095"
+    },
+    {
+      "id": "tutorials-ims#2093",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2093,
+      "title": "fix(publish): gate category self-heal to avoid OOM on bulk publishes",
+      "summary": "Full content publishes no longer risk exhausting backend memory while auto-categorizing tutorials.",
+      "category": "Fix",
+      "mergedAt": "2026-09-01T15:15:27Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2093"
+    },
+    {
+      "id": "tutorials-ims#2092",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2092,
+      "title": "fix(srv-qa): lazy-import category-classifier-llm to unbreak srv-qa boot",
+      "summary": "Deploy-stability fix so the QA content container boots reliably.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-31T21:29:34Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2092"
+    },
+    {
+      "id": "tutorials-ims#2091",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2091,
+      "title": "fix(ci): allowlist srv-only publish-contributors + publish-validation-rules routes",
+      "summary": "Build-guard update covering the new contributor and validation-rule publish routes.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-31T21:29:22Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2091"
+    },
+    {
+      "id": "tutorials-ims#2090",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2090,
+      "title": "Admin OP Phase 3: Knowledge-Graph facet",
+      "summary": "The admin Tutorials page gains a Knowledge-Graph facet surfacing the graph relationships computed nightly.",
+      "category": "Feature",
+      "mergedAt": "2026-08-31T20:30:02Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2090"
+    },
+    {
+      "id": "tutorials-ims#2089",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2089,
+      "title": "Admin OP Phase 2: Media facet + Freshness report header",
+      "summary": "The admin Tutorials page adds a Media facet with object-store visibility plus a freshness run-history header.",
+      "category": "Feature",
+      "mergedAt": "2026-08-31T19:49:05Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2089"
+    },
+    {
+      "id": "tutorials-ims#2088",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2088,
+      "title": "Admin OP Phase 1: fix empty Categories / Contributors / Validation facets",
+      "summary": "Fixed three empty facets — Categories, Contributors, and Validation — on the admin Tutorials page.",
+      "category": "Fix",
+      "mergedAt": "2026-08-31T19:08:22Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2088"
+    },
+    {
+      "id": "tutorials-ims#2087",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2087,
+      "title": "fix(docs): unbreak VitePress build — backtick bare <mission> in gotchas.md",
+      "summary": "Fixed the developer documentation site build.",
+      "category": "Docs",
+      "mergedAt": "2026-08-31T15:29:27Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2087"
+    },
+    {
+      "id": "tutorials-ims#2086",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2086,
+      "title": "docs: slim CLAUDE.md Top Gotchas (relocate detail to gotchas.md)",
+      "summary": "Streamlined the internal contributor guidance for faster, leaner tooling sessions.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-31T15:19:34Z",
+      "week": "2026-W36",
+      "weekStart": "2026-08-31",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2086"
+    },
+    {
+      "id": "tutorials-ims#2084",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2084,
+      "title": "chore: sync main into DEV (reconcile hotfixes #2081 + #2083)",
+      "summary": "Reconciled two production hotfixes back into the development branch to keep branches in sync.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-29T06:56:28Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2084"
+    },
+    {
+      "id": "tutorials-ims#2083",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2083,
+      "title": "fix(admin): Feature Flags Enable/Disable buttons (Unknown action import)",
+      "summary": "The Enable/Disable buttons on the admin Feature Flags page work again.",
+      "category": "Fix",
+      "mergedAt": "2026-08-29T06:45:56Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2083"
+    },
+    {
+      "id": "tutorials-ims#2081",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2081,
+      "title": "fix(rebuild-content): fetch topic-clusters/featured-topics/topics-gallery/tags so homepage bands bake fresh",
+      "summary": "The homepage Explore 'topic clusters' band now shows fresh, curated topic data instead of falling back to a tutorials-only list.",
+      "category": "Fix",
+      "mergedAt": "2026-08-28T23:23:27Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2081"
+    },
+    {
+      "id": "tutorials-ims#2080",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2080,
+      "title": "Release 1.20.1 → PROD",
+      "summary": "Shipped release 1.20.1 to production.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-28T21:07:50Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2080"
+    },
+    {
+      "id": "tutorials-ims#2078",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2078,
+      "title": "chore(release): bump MTA 1.20.0 → 1.20.1 + refresh What's New digest",
+      "summary": "Release 1.20.1 preparation and What's New digest refresh.",
+      "category": "Maintenance",
+      "mergedAt": "2026-08-28T20:52:20Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2078"
+    },
+    {
+      "id": "tutorials-ims#2079",
+      "repo": "tutorials-ims",
+      "label": "Developer Portal",
+      "number": 2079,
+      "title": "fix(homepage): boot-seed HomepageShelves; retire seed CSV + manual seed:thirdparty",
+      "summary": "Curated homepage shelf links (Prior Labs, Dremio, Hugging Face, and others) no longer disappear after a deployment.",
+      "category": "Fix",
+      "mergedAt": "2026-08-28T20:52:09Z",
+      "week": "2026-W35",
+      "weekStart": "2026-08-24",
+      "url": "https://github.com/sap-tutorials/tutorials-ims/pull/2079"
+    },
     {
       "id": "tutorials-ims#2076",
       "repo": "tutorials-ims",
diff --git a/hugo/layouts/partials/tutorial-meta.html b/hugo/layouts/partials/tutorial-meta.html
index b9e40134d..30d948444 100644
--- a/hugo/layouts/partials/tutorial-meta.html
+++ b/hugo/layouts/partials/tutorial-meta.html
@@ -14,7 +14,11 @@
   {{ with .Params.displayTags }}
   <span class="meta-tags">
     <svg class="meta-icon-svg" viewBox="0 0 16 16" width="14" height="14"><path d="M2 2h5.5l6.5 6.5-5.5 5.5L2 7.5V2zm3 1.5a1.5 1.5 0 1 0 0 3 1.5 1.5 0 0 0 0-3z" fill="currentColor" opacity="0.6"/></svg>
-    {{ range . }}{{ if ne . "License" }}<span class="tutorial-tag">{{ . }}</span>{{ end }}{{ end }}
+    {{/* #2112 — Overview tags now deep-link to /tutorials/?tag=<slug> for parity with the
+         header chips (u1-object-page.html). Zip displayTags with displayTagSlugs; fall back
+         to a plain span when a slug is missing. "License" stays label-matched + skipped. */}}
+    {{ $slugs := $.Params.displayTagSlugs }}
+    {{ range $i, $label := . }}{{ if ne $label "License" }}{{ $slug := "" }}{{ if and $slugs (lt $i (len $slugs)) }}{{ $slug = index $slugs $i }}{{ end }}{{ if $slug }}<a class="tutorial-tag tutorial-tag--link" href="{{ "/tutorials/" | relURL }}?tag={{ $slug | urlquery }}" aria-label="Filter tutorials by {{ $label }}">{{ $label }}</a>{{ else }}<span class="tutorial-tag">{{ $label }}</span>{{ end }}{{ end }}{{ end }}
   </span>
   {{ end }}
   {{ if in .Params.tags "tutorial>license" }}
diff --git a/hugo/layouts/topics/list.html b/hugo/layouts/topics/list.html
deleted file mode 100644
index 02cec0cc0..000000000
--- a/hugo/layouts/topics/list.html
+++ /dev/null
@@ -1,79 +0,0 @@
-{{ define "main" }}
-{{- /*
-  topics/list.html — Topics gallery page (/topics/).
-  Renders a card grid from site.Data.topics_gallery.gallery.
-  Progressive enhancement: map island mounts into #topics-map when
-  /js/topics-map.js is present (built in Task 9). Safe if absent.
-
-  Data shape (hugo/data/topics_gallery.json):
-    { gallery: [{slug, label, rationale, memberCount, tutorialCount,
-                  topConcepts:[{slug,name}]}],
-      clusters: {slug: {...}}, buildAt, error }
-*/ -}}
-{{- $g := site.Data.topics_gallery -}}
-{{- $css := resources.Get "css/topics.css" | fingerprint -}}
-{{ if $css }}<link rel="stylesheet" href="{{ $css.RelPermalink }}">{{ end }}
-
-<div class="topics-page">
-
-  <header class="topics-hero">
-    <div class="topics-hero__inner">
-      <h1 class="topics-hero__title">Explore topics</h1>
-      <p class="topics-hero__intro">Browse curated clusters of related SAP developer concepts and follow a suggested learning path through each topic.</p>
-      <form class="topics-search" role="search" action="/search/" method="get">
-        <label for="topics-search-input" class="topics-search__label">Search</label>
-        <input
-          id="topics-search-input"
-          class="topics-search__input"
-          type="search"
-          name="q"
-          placeholder="Search tutorials, concepts…"
-          aria-label="Search tutorials and concepts"
-        >
-        <button type="submit" class="topics-search__btn" aria-label="Submit search">
-          <span aria-hidden="true">&#x2315;</span>
-        </button>
-      </form>
-      <p class="topics-hero__graphlink"><a href="/explore/">See the full knowledge graph →</a></p>
-    </div>
-  </header>
-
-  {{ if and $g (gt (len $g.gallery) 0) }}
-  <section class="topics-gallery" aria-label="Topic clusters">
-    <ul class="topics-gallery__grid" role="list">
-      {{- range $g.gallery -}}
-      <li class="topics-card">
-        <a class="topics-card__link" href="/topics/{{ .slug }}/">
-          <h2 class="topics-card__label">{{ .label }}</h2>
-          {{- with .rationale }}
-          <p class="topics-card__rationale">{{ . | truncate 120 }}</p>
-          {{- end }}
-          <div class="topics-card__meta">
-            <span class="topics-card__counts">{{ .memberCount }} concepts &middot; {{ .tutorialCount }} tutorials</span>
-          </div>
-          {{- with .topConcepts }}
-          <ul class="topics-card__chips" role="list" aria-label="Top concepts">
-            {{- range first 4 . -}}
-            <li class="topics-card__chip">{{ .name }}</li>
-            {{- end -}}
-          </ul>
-          {{- end }}
-        </a>
-      </li>
-      {{- end -}}
-    </ul>
-  </section>
-  {{ else }}
-  <section class="topics-empty" aria-label="Topics not yet available">
-    <p class="topics-empty__msg">Topic clusters are being prepared. Check back shortly, or <a href="/search/">search tutorials</a> directly.</p>
-  </section>
-  {{ end }}
-
-  {{- /* Map island mount point. Populated by /js/topics-map.js (built by hugo-apps,
-         always present after npm run build:apps). Mount is inert until JS loads,
-         so no empty-state guard is needed here — same posture as concepts-filter.js. */ -}}
-  <section id="topics-map" class="topics-map-section" data-vue-island="topics-map" aria-label="Topic map" aria-hidden="true"></section>
-  <script type="module" src="{{ partial "island-src.html" "topics-map" }}" defer></script>
-
-</div>
-{{ end }}
diff --git a/hugo/layouts/topics/single.html b/hugo/layouts/topics/single.html
deleted file mode 100644
index cec21785e..000000000
--- a/hugo/layouts/topics/single.html
+++ /dev/null
@@ -1,108 +0,0 @@
-{{ define "main" }}
-{{- /*
-  topics/single.html — Cluster detail page (/topics/<slug>/).
-  Reads cluster data from site.Data.topics_gallery.clusters keyed by
-  .Params.cluster (set in the per-cluster content stub written by
-  scripts/fetch-topics-gallery.ts).
-
-  Data shape for a cluster entry:
-    { slug, label, rationale, memberCount, tutorialCount,
-      orderMode: 'path'|'ranked',
-      concepts: [{slug, name}],
-      peers: [{slug, label, weight}] }
-*/ -}}
-{{- $c := index site.Data.topics_gallery.clusters .Params.cluster -}}
-{{- $css := resources.Get "css/topics.css" | fingerprint -}}
-{{ if $css }}<link rel="stylesheet" href="{{ $css.RelPermalink }}">{{ end }}
-
-{{ if $c }}
-
-<article class="topics-detail">
-
-  <nav class="topics-breadcrumb" aria-label="Breadcrumb">
-    <ol class="topics-breadcrumb__list">
-      <li class="topics-breadcrumb__item"><a class="topics-breadcrumb__link" href="/">Home</a></li>
-      <li class="topics-breadcrumb__sep" aria-hidden="true">/</li>
-      <li class="topics-breadcrumb__item"><a class="topics-breadcrumb__link" href="/topics/">Topics</a></li>
-      <li class="topics-breadcrumb__sep" aria-hidden="true">/</li>
-      <li class="topics-breadcrumb__item topics-breadcrumb__item--current" aria-current="page">{{ $c.label }}</li>
-    </ol>
-  </nav>
-
-  <header class="topics-detail__header">
-    <h1 class="topics-detail__title">{{ $c.label }}</h1>
-    {{- with $c.rationale }}
-    <p class="topics-detail__rationale">{{ . }}</p>
-    {{- end }}
-    <div class="topics-detail__meta">
-      <span class="topics-detail__counts">{{ $c.memberCount }} concepts &middot; {{ $c.tutorialCount }} tutorials</span>
-    </div>
-  </header>
-
-  {{- /* Suggested order / concept list — switches on orderMode */ -}}
-  {{ with $c.concepts }}
-  <section class="topics-detail__concepts" aria-labelledby="topics-concepts-heading">
-    {{ if eq $c.orderMode "path" }}
-    <h2 id="topics-concepts-heading" class="topics-detail__section-title">A suggested order through this topic</h2>
-    <ol class="topics-concepts-list topics-concepts-list--ordered">
-      {{- range . -}}
-      <li class="topics-concepts-list__item">
-        <a class="topics-concepts-list__link" href="/concepts/{{ .slug }}/">{{ .name }}</a>
-      </li>
-      {{- end -}}
-    </ol>
-    {{ else }}
-    <h2 id="topics-concepts-heading" class="topics-detail__section-title">Concepts in this topic</h2>
-    <ul class="topics-concepts-list topics-concepts-list--unordered">
-      {{- range . -}}
-      <li class="topics-concepts-list__item">
-        <a class="topics-concepts-list__link" href="/concepts/{{ .slug }}/">{{ .name }}</a>
-      </li>
-      {{- end -}}
-    </ul>
-    {{ end }}
-  </section>
-  {{ end }}
-
-  {{- /* Peer clusters section */ -}}
-  {{ with $c.peers }}
-  <section class="topics-detail__peers" aria-labelledby="topics-peers-heading">
-    <h2 id="topics-peers-heading" class="topics-detail__section-title">Topics that connect to this one</h2>
-    <ul class="topics-peers-list" role="list">
-      {{- range . -}}
-      <li class="topics-peers-list__item">
-        <a class="topics-peers-list__link" href="/topics/{{ .slug }}/">{{ .label }}</a>
-      </li>
-      {{- end -}}
-    </ul>
-  </section>
-  {{ end }}
-
-  {{- /* Optional mini-map island: progressively enhanced.
-         data-focus-cluster is read by the topics-map island to
-         highlight the current cluster in the graph. */ -}}
-  <div
-    class="topics-detail__map"
-    data-vue-island="topics-map"
-    data-focus-cluster="{{ .Params.cluster }}"
-    aria-hidden="true"
-  ></div>
-  <script type="module" src="{{ partial "island-src.html" "topics-map" }}" defer></script>
-
-</article>
-
-{{ else }}
-<div class="topics-detail topics-detail--missing">
-  <nav class="topics-breadcrumb" aria-label="Breadcrumb">
-    <ol class="topics-breadcrumb__list">
-      <li class="topics-breadcrumb__item"><a class="topics-breadcrumb__link" href="/">Home</a></li>
-      <li class="topics-breadcrumb__sep" aria-hidden="true">/</li>
-      <li class="topics-breadcrumb__item"><a class="topics-breadcrumb__link" href="/topics/">Topics</a></li>
-    </ol>
-  </nav>
-  <h1>Topic not found</h1>
-  <p>The cluster data for this topic was not available at build time. <a href="/topics/">Browse all topics</a>.</p>
-</div>
-{{ end }}
-
-{{ end }}
diff --git a/package.json b/package.json
index 22221db2d..835766644 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,6 @@
     "fetch-shelf-definitions": "tsx scripts/fetch-shelf-definitions.ts",
     "fetch-featured-topics": "tsx scripts/fetch-featured-topics.ts",
     "fetch-topic-clusters": "tsx scripts/fetch-topic-clusters.ts",
-    "fetch-topics-gallery": "tsx scripts/fetch-topics-gallery.ts",
     "fetch-tutorials:hugo": "tsx scripts/fetch-tutorials.ts --target hugo",
     "fetch-advocates": "tsx scripts/fetch-advocates.ts",
     "seed-ai-quizzes": "cross-env AI_AUTHOR_BUILD_CAP=10000 npm run fetch-tutorials",
@@ -88,7 +87,7 @@
     "build:display": "cd app/display-app && npm install && npm run build",
     "copy-joule-vendor": "node scripts/copy-joule-vendor.mjs",
     "check-deploy-cap-target": "node scripts/check-deploy-cap-target.cjs",
-    "build:all": "npm run prebuild && npm run fetch-tutorials -- --regenerate && npm run fetch-advocates && npm run fetch-homepage-shelves && npm run fetch-verb-definitions && npm run fetch-tags && npm run fetch-shelf-definitions && npm run fetch-featured-topics && npm run fetch-topic-clusters && npm run fetch-topics-gallery && npm run build:icon-subset && npm run build:css && npm run build:apps && npm run build:island-manifest && npm run check:ui5-single-copy && npx tsx scripts/check-ui5-entry-coverage.ts && npm run build:analytics-explorer && npm run copy-joule-vendor && npm run build:explore && npm run build:hugo && npm run build:page-fallback && npm run build:whats-new-snapshot && npm run retain:assets && npm run build:publish-island-manifest && npm run build:highlight && npm run build:display && npm run build:sdl",
+    "build:all": "npm run prebuild && npm run fetch-tutorials -- --regenerate && npm run fetch-advocates && npm run fetch-homepage-shelves && npm run fetch-verb-definitions && npm run fetch-tags && npm run fetch-shelf-definitions && npm run fetch-featured-topics && npm run fetch-topic-clusters && npm run build:icon-subset && npm run build:css && npm run build:apps && npm run build:island-manifest && npm run check:ui5-single-copy && npx tsx scripts/check-ui5-entry-coverage.ts && npm run build:analytics-explorer && npm run copy-joule-vendor && npm run build:explore && npm run build:hugo && npm run build:page-fallback && npm run build:whats-new-snapshot && npm run retain:assets && npm run build:publish-island-manifest && npm run build:highlight && npm run build:display && npm run build:sdl",
     "build:deploy": "npm run check-deploy-cap-target && npm run build:all",
     "deploy": "node scripts/deploy-mta.cjs",
     "build:admin": "npm --prefix app/admin-shell run build",
diff --git a/scripts/backfill-categories.cjs b/scripts/backfill-categories.cjs
index b0c2d4a13..f3c783092 100644
--- a/scripts/backfill-categories.cjs
+++ b/scripts/backfill-categories.cjs
@@ -40,6 +40,28 @@ function kindToEntity(kind) {
   return map[kind];
 }
 
+/**
+ * Resolve the ims namespace entities robustly across contexts.
+ *
+ * In a standalone `cds bind --exec` runner the model may not be linked into
+ * the cds.entities() globals (cds.model unset), so fall back to explicitly
+ * loading + linking (same gotcha as srv/lib/seed-poc-puzzle.js). Returns the
+ * RESOLVED entity objects — SELECT/DELETE/INSERT against a bare short-name
+ * STRING ('Tutorials') does NOT resolve to the namespaced HANA table
+ * (COM_SAP_DEVELOPERS_IMS_TUTORIALS) and dies with "Could not find table/view
+ * TUTORIALS"; it only ever worked against local SQLite.
+ *
+ * @param {typeof import('@sap/cds')} cds
+ * @returns {Promise<Record<string, any>>}
+ */
+async function resolveImsEntities(cds) {
+  if (typeof cds.entities === 'function' && cds.model) {
+    return cds.entities('com.sap.developers.ims');
+  }
+  const linked = cds.linked(await cds.load('*'));
+  return linked.entities('com.sap.developers.ims');
+}
+
 /**
  * Run a batch of items concurrently using Promise.allSettled.
  * @param {Array} items
@@ -64,6 +86,10 @@ async function main(argv) {
   // Connect to database
   const db = await cds.connect.to('db');
 
+  // Resolve namespaced entity objects once (see resolveImsEntities). Passing a
+  // bare short-name string to SELECT.from fails against HANA.
+  const ims = await resolveImsEntities(cds);
+
   // Dynamic import for ESM module
   const { classifyAndPersist } = await import('../srv/lib/category-classifier.js');
 
@@ -79,7 +105,7 @@ async function main(argv) {
 
     // Fetch all IDs ordered
     const rows = await db.run(
-      SELECT.from(entityName).columns('ID').orderBy('ID')
+      SELECT.from(ims[entityName]).columns('ID').orderBy('ID')
     );
 
     let items = rows;
diff --git a/scripts/check-srv-qa-route-drift.ts b/scripts/check-srv-qa-route-drift.ts
index d7907329b..49d55915a 100644
--- a/scripts/check-srv-qa-route-drift.ts
+++ b/scripts/check-srv-qa-route-drift.ts
@@ -93,6 +93,21 @@ const ALLOWLIST_ONLY_ON_SRV: Record<string, string> = {
     'Concept-detail publish rendering (#1327 Task 3) — renders concept pages into a publish ' +
     'session for the same public prod concept surface as GET /content/concepts/:slug. Not ' +
     'a tutorial-draft author-preview endpoint; the QA channel has no concept publish flow.',
+  'GET /content/topics/:slug':
+    'KG topic landing pages (tag-tree-topics, #2099) — a public prod content surface that ' +
+    'mirrors GET /content/concepts/:slug (topic- prefixed BLOBs, legacy-slug 301 resolution), ' +
+    'not tutorial-draft author preview. The QA channel serves in-flight tutorials from ' +
+    '-Contribution repos; topic pages are out of its scope and srv-qa wires no topic serve flow.',
+  'GET /content/topics-index':
+    'CAP-served /topics/ LIST page (tag-tree-topics, #2099) — the index companion to ' +
+    'GET /content/topics/:slug above, same public prod content surface as the concepts-index ' +
+    'entry it mirrors, not tutorial-draft author preview. The QA channel serves in-flight ' +
+    'tutorials; topic pages are out of its scope and srv-qa wires no topicsIndexHandler.',
+  'POST /content/publish/render-topics':
+    'Topic-detail publish rendering (tag-tree-topics, #2099) — renders topic pages into a ' +
+    'publish session for the same public prod topic surface as GET /content/topics/:slug, ' +
+    'mirroring render-concepts exactly. Not a tutorial-draft author-preview endpoint; the QA ' +
+    'channel has no topic publish flow.',
   'POST /content/orphan-purge':
     'CI-only batched soft-delete for prod content maintenance (#823). Not an author-preview ' +
     'endpoint — the QA channel has no orphan-purge maintenance flow.',
@@ -102,6 +117,18 @@ const ALLOWLIST_ONLY_ON_SRV: Record<string, string> = {
     '(com.sap.developers.ims.qa) does not load, and srv-qa has no runtime reader of ' +
     'ValidateAnswerSpecs (author preview re-parses rules.vr live). The publish CLI skips this ' +
     'step for channel=qa. Re-evaluate only if QA gains a runtime /api/validate-answer surface.',
+  'POST /content/publish-contributors':
+    'Contributor sidecar publish (#WS2). Same rationale as validate-answer-specs above: srv-qa ' +
+    'has no ContributorCache entity (the QA model com.sap.developers.ims.qa does not load it), ' +
+    'so a POST would 404/500, and there is no QA runtime reader. The publish CLI already skips ' +
+    'this step for channel=qa (scripts/publish-content.ts: "[publish-contributors] skipped"). ' +
+    'Re-evaluate only if QA gains a contributor reader.',
+  'POST /content/publish-validation-rules':
+    'Validation-rules sidecar publish (#WS3). Same rationale as publish-contributors above: ' +
+    'srv-qa has no ValidationRules entity, so a POST would 404/500, and there is no QA runtime ' +
+    'reader. The publish CLI already skips this step for channel=qa ' +
+    '(scripts/publish-content.ts: "[publish-validation-rules] skipped"). Re-evaluate only if ' +
+    'QA gains a validation-rules reader.',
   'GET /content/authors/:login':
     'CAP-served /authors/{login}/ pages (#1659 Phase C) — a public prod content surface that ' +
     'aggregates across published tutorials, not tutorial-draft author preview. Same rationale ' +
diff --git a/scripts/fetch-topics-gallery.ts b/scripts/fetch-topics-gallery.ts
deleted file mode 100644
index cb413442a..000000000
--- a/scripts/fetch-topics-gallery.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-
-const OUT = join('hugo', 'data', 'topics_gallery.json');
-const CONTENT_DIR = join('hugo', 'content', 'topics');
-const INDEX_STUB = '_index.md';
-
-export async function writeTopicsGallery(capBase = process.env.CAP_BASE_URL || 'http://localhost:4004') {
-  let payload: any;
-  try {
-    const res = await fetch(`${capBase}/build/topics-gallery`);
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    payload = await res.json();
-  } catch (err) {
-    console.warn(`[fetch-topics-gallery] fail-open: ${(err as Error).message}`);
-    payload = { gallery: [], clusters: {}, buildAt: new Date().toISOString(), error: 'fetch_failed' };
-  }
-  mkdirSync(dirname(OUT), { recursive: true });
-  writeFileSync(OUT, JSON.stringify(payload, null, 2));
-  console.log(`[fetch-topics-gallery] wrote ${payload.gallery?.length ?? 0} cards -> ${OUT}`);
-
-  // Write per-cluster content stubs (Hugo needs a .md per cluster to bake detail pages)
-  mkdirSync(CONTENT_DIR, { recursive: true });
-
-  // Remove stale stubs (all *.md except _index.md)
-  try {
-    const existing = readdirSync(CONTENT_DIR);
-    for (const f of existing) {
-      if (f.endsWith('.md') && f !== INDEX_STUB) {
-        unlinkSync(join(CONTENT_DIR, f));
-      }
-    }
-  } catch {
-    // CONTENT_DIR may not exist yet on very first run — mkdirSync above ensures it
-  }
-
-  // Write one stub per cluster
-  const clusters = payload.clusters ?? {};
-  for (const slug of Object.keys(clusters)) {
-    const cluster = clusters[slug];
-    const label = (cluster.label ?? slug).replace(/"/g, '\\"');
-    const stub = [
-      '---',
-      `title: "${label}"`,
-      `type: topics`,
-      `layout: single`,
-      `cluster: "${slug}"`,
-      '---',
-      '',
-    ].join('\n');
-    writeFileSync(join(CONTENT_DIR, `${slug}.md`), stub);
-  }
-  console.log(`[fetch-topics-gallery] wrote ${Object.keys(clusters).length} cluster stubs -> ${CONTENT_DIR}/`);
-}
-
-// CLI entry (tsx scripts/fetch-topics-gallery.ts)
-if (import.meta.url === `file://${process.argv[1]}`) {
-  writeTopicsGallery().catch(e => { console.error(e); process.exit(1); });
-}
diff --git a/scripts/fetch-tutorials.ts b/scripts/fetch-tutorials.ts
index 57edb7a1b..ba3fb4402 100644
--- a/scripts/fetch-tutorials.ts
+++ b/scripts/fetch-tutorials.ts
@@ -15,7 +15,7 @@ import {
   navEntriesBySlug,
   SIDECAR_VERSION,
 } from './lib/content-cache.js'
-import { parseRulesVrEnriched, collectAiGradedSpecs } from './parsers/rules.js'
+import { parseRulesVrEnriched, collectAiGradedSpecs, collectAllRules } from './parsers/rules.js'
 import { expandAiAuthoredQuestions, populateAiAuthoredSiblingMaps, type ExpandStats } from './lib/expand-ai-authored.js'
 import { loadAiQuizCache, saveAiQuizCache } from './lib/ai-quiz-cache.js'
 import { callQuizModel } from '../srv/lib/ai-quiz-llm.js'
@@ -31,6 +31,7 @@ import type { CatalogTutorialMeta, CategoryMeta, Mission, MissionHierarchy, Hier
 import { QUESTION_TYPE_TEXT } from './parsers/types.js'
 import { advocateLoginToSlug, type AuthorTutorialRow } from './parsers/author-index.js'
 import { writeAuthorPages } from './lib/author-pages-writer.js'
+import { buildContributorsSidecar } from './parsers/contributors-sidecar.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 
@@ -1042,6 +1043,16 @@ async function main() {
           writeFileSync(validateSidecarPath, JSON.stringify({ slug: t.slug.toLowerCase(), specs: aiGradedSpecs }, null, 2))
         }
 
+        // Write full validation-rules sidecar (all rule types, all steps).
+        // Consumed by the publish pipeline to upsert TutorialValidationRules rows.
+        const allRules = collectAllRules(validationMap, ruleTypeByStepAndId, correctAnswerByStepAndId)
+        if (allRules.length > 0) {
+          writeFileSync(
+            join(CACHE_DIR, `${t.slug.toLowerCase()}.validation-rules.json`),
+            JSON.stringify({ slug: t.slug.toLowerCase(), rules: allRules }, null, 2),
+          )
+        }
+
         // [#208] Anti-leak strip: AI-authored text questions had correctAnswer
         // restored on validationMap so populateAiAuthoredSiblingMaps (above)
         // could mirror it into correctAnswerByStepAndId, which collectAiGradedSpecs
@@ -1076,6 +1087,14 @@ async function main() {
         }
       }
 
+      const contribSidecar = buildContributorsSidecar(t.slug, contributors)
+      if (contribSidecar) {
+        writeFileSync(
+          join(CACHE_DIR, `${t.slug.toLowerCase()}.contributors.json`),
+          JSON.stringify(contribSidecar, null, 2),
+        )
+      }
+
       const rawNavSlugs = [...new Set([frontmatter.primary_tag ?? '', ...(frontmatter.tags ?? [])])]
         .map(s => s.replace(/\\/g, '')).filter(s => s.length > 0)
 
diff --git a/scripts/lib/publish-client.ts b/scripts/lib/publish-client.ts
index 121e60855..a1e5e053e 100644
--- a/scripts/lib/publish-client.ts
+++ b/scripts/lib/publish-client.ts
@@ -100,6 +100,26 @@ export async function renderConceptsPhase(i: RenderConceptsInput): Promise<Rende
   return postJson(`${i.baseUrl}/content/publish/render-concepts`, i.apiKey, { sessionId: i.sessionId });
 }
 
+export interface RenderTopicsInput { baseUrl: string; apiKey: string; sessionId: string }
+export interface RenderTopicsResult {
+  topicsSeen: number;
+  topicsChanged: number;
+  topicsSkipped: number;
+  topicsErrored: number;
+  durationMs: number;
+}
+
+/**
+ * tag-tree-topics Task 7 — trigger the server-side render-topics phase within
+ * an open publish session. CAP reads live tags, renders each topic detail page,
+ * and appends `topic-<slug>` BLOBs to the session (delta skips unchanged).
+ * Mirrors renderConceptsPhase exactly: must run AFTER the __shell__ sidecar is
+ * present and BEFORE commit.
+ */
+export async function renderTopicsPhase(i: RenderTopicsInput): Promise<RenderTopicsResult> {
+  return postJson(`${i.baseUrl}/content/publish/render-topics`, i.apiKey, { sessionId: i.sessionId });
+}
+
 export async function abortSession({ baseUrl, apiKey, sessionId, reason }: {
   baseUrl: string; apiKey: string; sessionId: string; reason?: string;
 }): Promise<{ aborted: boolean }> {
diff --git a/scripts/parsers/contributors-sidecar.ts b/scripts/parsers/contributors-sidecar.ts
new file mode 100644
index 000000000..f9eed7f84
--- /dev/null
+++ b/scripts/parsers/contributors-sidecar.ts
@@ -0,0 +1,15 @@
+export interface SidecarContributor { login: string; name: string; email: string; avatarUrl: string }
+export interface ContributorsSidecar { slug: string; contributors: SidecarContributor[] }
+
+export function buildContributorsSidecar(
+  slug: string,
+  contributors: Array<Partial<SidecarContributor>>,
+): ContributorsSidecar | null {
+  if (!contributors || contributors.length === 0) return null
+  return {
+    slug: slug.toLowerCase(),
+    contributors: contributors.slice(0, 10).map((c) => ({
+      login: c.login ?? '', name: c.name ?? '', email: c.email ?? '', avatarUrl: c.avatarUrl ?? '',
+    })),
+  }
+}
diff --git a/scripts/parsers/rules.ts b/scripts/parsers/rules.ts
index b2791a961..0018db098 100644
--- a/scripts/parsers/rules.ts
+++ b/scripts/parsers/rules.ts
@@ -294,6 +294,56 @@ function parseChoiceOptions(content: string): { options: string[]; correctAnswer
 
 export { parseCodeCheckBlocks } from './codecheck.js'
 
+export interface AllRuleRow {
+  stepNumber: number
+  questionId: string
+  questionText: string
+  ruleType: string
+  questionType: 'MCQ' | 'TEXT'
+  choiceMode: string | null
+  options: string | null
+  correctAnswer: string | null
+  aiGrading: boolean
+}
+
+/**
+ * Collect ALL validation rules across all steps for a tutorial — both
+ * AI-graded and client-graded (MCQ single/multiple, exact-match text).
+ *
+ * Parallel to collectAiGradedSpecs but returns every emitted question so the
+ * publish pipeline can persist a full all-rules sidecar and the admin UI can
+ * surface a complete rule facet (issue WS3).
+ *
+ * Anti-leak contract preserved: correctAnswer is null for AI-graded rows —
+ * the reference answer stays server-side in ValidateAnswerSpecs only.
+ */
+export function collectAllRules(
+  map: Map<number, ValidationQuestion[]>,
+  ruleTypeByStepAndId: Map<string, string>,
+  correctAnswerByStepAndId: Map<string, string>,
+): AllRuleRow[] {
+  const rows: AllRuleRow[] = []
+  for (const [stepNumber, questions] of map.entries()) {
+    for (const q of questions) {
+      const key = `${stepNumber}:${q.id}`
+      const isMcq = q.type === QUESTION_TYPE_MCQ
+      const ai = Boolean((q as any).aiGrading)
+      rows.push({
+        stepNumber,
+        questionId: q.id,
+        questionText: q.question,
+        ruleType: ruleTypeByStepAndId.get(key) ?? '',
+        questionType: isMcq ? 'MCQ' : 'TEXT',
+        choiceMode: (q as any).choiceMode ?? null,
+        options: isMcq && (q as any).options ? JSON.stringify((q as any).options) : null,
+        correctAnswer: ai ? null : (correctAnswerByStepAndId.get(key) ?? (q as any).correctAnswer ?? null),
+        aiGrading: ai,
+      })
+    }
+  }
+  return rows
+}
+
 export interface AiGradedSpec {
   stepNumber: number
   questionId: string
diff --git a/scripts/publish-content.ts b/scripts/publish-content.ts
index 9761957db..e1bd2535e 100644
--- a/scripts/publish-content.ts
+++ b/scripts/publish-content.ts
@@ -5,11 +5,13 @@ import { gzipSync } from 'node:zlib';
 import { userInfo, hostname } from 'node:os';
 import { parse as parseYaml } from 'yaml';
 import { parseChannel, type Channel } from './fetch-tutorials.js';
-import { beginSession, appendBatch, commitSession, abortSession, fetchRemoteHashes, fetchRemoteSourceHashes, renderConceptsPhase } from './lib/publish-client.js';
+import { beginSession, appendBatch, commitSession, abortSession, fetchRemoteHashes, fetchRemoteSourceHashes, renderConceptsPhase, renderTopicsPhase } from './lib/publish-client.js';
 import { withRetry, formatErrorChain } from './lib/publish-retry.js';
 import { chunk, runConcurrent } from './lib/publish-batcher.js';
 import { collectCodeCheckSpecs, publishCodeCheckSpecs } from './lib/publish-codecheck.js';
 import { publishValidateAnswerSpecs } from './lib/publish-validate-answer.js';
+import { publishContributors } from './publish/publish-contributors.js';
+import { publishValidationRules } from './publish/publish-validation-rules.js';
 import { computeOrphans, enforceCap, formatStepSummary } from './lib/purge-orphans.js';
 import { discoverPageFiles, discoverAuthorPages, discoverAdvocatePages } from '../srv/lib/page-key-map.js';
 
@@ -1243,6 +1245,25 @@ async function main() {
       await abortSession({ baseUrl: opts.baseUrl, apiKey: opts.apiKey, sessionId: begin.sessionId, reason: 'render-concepts failed' });
       process.exit(1);
     }
+    // tag-tree-topics Task 7 — render topic detail pages alongside concepts.
+    // Same guard (prod-only, full-publish): POST /content/publish/render-topics
+    // is not registered on srv-qa (topics are a prod-only content surface).
+    try {
+      const rt = await withRetry(
+        () => renderTopicsPhase({ baseUrl: opts.baseUrl, apiKey: opts.apiKey, sessionId: begin.sessionId }),
+        {
+          attempts: 3, backoffMs: [1000, 3000, 9000],
+          onAttemptFail: (attempt, err, willRetry) => {
+            console.error(`[publish-content] render-topics failed (attempt ${attempt}/3): ${formatErrorChain(err)}${willRetry ? ' — retrying' : ''}`);
+          },
+        }
+      );
+      log(`render-topics: ${rt.topicsChanged} changed, ${rt.topicsSkipped} skipped, ${rt.topicsErrored} errored of ${rt.topicsSeen} (${rt.durationMs} ms)`);
+    } catch (err) {
+      console.error(`[publish-content] render-topics failed permanently: ${formatErrorChain(err)}`);
+      await abortSession({ baseUrl: opts.baseUrl, apiKey: opts.apiKey, sessionId: begin.sessionId, reason: 'render-topics failed' });
+      process.exit(1);
+    }
   }
 
   let commit;
@@ -1351,6 +1372,34 @@ async function main() {
     }
   }
 
+  // --- contributors sidecar publish (non-fatal auxiliary step, issue #WS2) ---
+  // QA channel skips: srv-qa has no ContributorCache entity, POST would 404/500.
+  if (channel === 'qa') {
+    log('[publish-contributors] skipped (channel=qa)');
+  } else {
+    try {
+      const cacheDir = join(process.cwd(), '.tutorial-cache');
+      const r = await publishContributors({ cacheDir, baseUrl: opts.baseUrl, apiKey: opts.apiKey });
+      log(`[publish-contributors] published ${r.published}/${r.total}`);
+    } catch (err) {
+      console.error('[publish-content] contributors publish failed (non-fatal):', formatErrorChain(err));
+    }
+  }
+
+  // --- validation-rules sidecar publish (non-fatal auxiliary step, issue #WS3) ---
+  // QA channel skips: srv-qa has no ValidationRules entity, POST would 404/500.
+  if (channel === 'qa') {
+    log('[publish-validation-rules] skipped (channel=qa)');
+  } else {
+    try {
+      const cacheDir = join(process.cwd(), '.tutorial-cache');
+      const r = await publishValidationRules({ cacheDir, baseUrl: opts.baseUrl, apiKey: opts.apiKey });
+      log(`[publish-validation-rules] published ${r.published}/${r.total}`);
+    } catch (err) {
+      console.error('[publish-content] validation-rules publish failed (non-fatal):', formatErrorChain(err));
+    }
+  }
+
   // --- auto-verify ---
   log('Verifying server state matches local...');
   let postRemote: Record<string, string>;
diff --git a/scripts/publish/publish-contributors.ts b/scripts/publish/publish-contributors.ts
new file mode 100644
index 000000000..337893c8d
--- /dev/null
+++ b/scripts/publish/publish-contributors.ts
@@ -0,0 +1,70 @@
+// scripts/publish/publish-contributors.ts
+// Non-fatal auxiliary publish step for issue #WS2.
+// Walks `cacheDir` for `*.contributors.json` sidecar files emitted by
+// scripts/fetch-tutorials.ts and POSTs each one to
+// /content/publish-contributors (Task 6 REPLACE handler).
+//
+// Auth: CONTENT_API_KEY via contentAuthMiddleware (Authorization: Bearer).
+// Failures are NON-FATAL — captured and returned to the caller.
+
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const SUFFIX = '.contributors.json'
+
+/**
+ * Walk cacheDir for *.contributors.json sidecar files,
+ * POST each one to /content/publish-contributors.
+ *
+ * @param opts.cacheDir  Tutorial cache dir (e.g. .tutorial-cache)
+ * @param opts.baseUrl   CAP base URL
+ * @param opts.apiKey    CONTENT_API_KEY value
+ * @returns { published, total }
+ */
+export async function publishContributors(opts: {
+  cacheDir: string
+  baseUrl: string
+  apiKey: string
+}): Promise<{ published: number; total: number }> {
+  const { cacheDir, baseUrl, apiKey } = opts
+  let files: string[]
+  try {
+    files = readdirSync(cacheDir).filter((f) => f.endsWith(SUFFIX))
+  } catch {
+    return { published: 0, total: 0 }
+  }
+
+  let published = 0
+  for (const f of files) {
+    const filePath = join(cacheDir, f)
+    let raw: string
+    try {
+      raw = readFileSync(filePath, 'utf8')
+    } catch {
+      continue
+    }
+
+    let res: Response
+    try {
+      res = await fetch(`${baseUrl}/content/publish-contributors`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Bearer ${apiKey}`,
+          'content-type': 'application/json',
+        },
+        body: raw,
+      })
+    } catch (err) {
+      console.warn(`[publish-contributors] network error for ${f}:`, (err as Error).message)
+      continue
+    }
+
+    if (res.ok) {
+      published += 1
+    } else {
+      console.warn(`[publish-contributors] ${f} -> ${res.status}`)
+    }
+  }
+
+  return { published, total: files.length }
+}
diff --git a/scripts/publish/publish-validation-rules.ts b/scripts/publish/publish-validation-rules.ts
new file mode 100644
index 000000000..5c1efcc39
--- /dev/null
+++ b/scripts/publish/publish-validation-rules.ts
@@ -0,0 +1,70 @@
+// scripts/publish/publish-validation-rules.ts
+// Non-fatal auxiliary publish step for issue #WS3.
+// Walks `cacheDir` for `*.validation-rules.json` sidecar files emitted by
+// scripts/fetch-tutorials.ts and POSTs each one to
+// /content/publish-validation-rules (Task 13 REPLACE handler).
+//
+// Auth: CONTENT_API_KEY via contentAuthMiddleware (Authorization: Bearer).
+// Failures are NON-FATAL — captured and returned to the caller.
+
+import { readdirSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const SUFFIX = '.validation-rules.json'
+
+/**
+ * Walk cacheDir for *.validation-rules.json sidecar files,
+ * POST each one to /content/publish-validation-rules.
+ *
+ * @param opts.cacheDir  Tutorial cache dir (e.g. .tutorial-cache)
+ * @param opts.baseUrl   CAP base URL
+ * @param opts.apiKey    CONTENT_API_KEY value
+ * @returns { published, total }
+ */
+export async function publishValidationRules(opts: {
+  cacheDir: string
+  baseUrl: string
+  apiKey: string
+}): Promise<{ published: number; total: number }> {
+  const { cacheDir, baseUrl, apiKey } = opts
+  let files: string[]
+  try {
+    files = readdirSync(cacheDir).filter((f) => f.endsWith(SUFFIX))
+  } catch {
+    return { published: 0, total: 0 }
+  }
+
+  let published = 0
+  for (const f of files) {
+    const filePath = join(cacheDir, f)
+    let raw: string
+    try {
+      raw = readFileSync(filePath, 'utf8')
+    } catch {
+      continue
+    }
+
+    let res: Response
+    try {
+      res = await fetch(`${baseUrl}/content/publish-validation-rules`, {
+        method: 'POST',
+        headers: {
+          'authorization': `Bearer ${apiKey}`,
+          'content-type': 'application/json',
+        },
+        body: raw,
+      })
+    } catch (err) {
+      console.warn(`[publish-validation-rules] network error for ${f}:`, (err as Error).message)
+      continue
+    }
+
+    if (res.ok) {
+      published += 1
+    } else {
+      console.warn(`[publish-validation-rules] ${f} -> ${res.status}`)
+    }
+  }
+
+  return { published, total: files.length }
+}
diff --git a/srv/admin-service.cds b/srv/admin-service.cds
index 3a872801d..9e3bf132e 100644
--- a/srv/admin-service.cds
+++ b/srv/admin-service.cds
@@ -9,6 +9,8 @@ using from '../db/homepage-featured';
 using from '../db/views';
 using from '../db/devtoberfest-analytics';
 using from '../db/mcp-pats';
+using from '../db/tutorial-images';
+using from '../db/tutorial-assets';
 using from '../app/admin-annotations';
 using { external.devtoberfest as external_dtf } from '../db/external/devtoberfest';
 
@@ -64,6 +66,7 @@ service AdminService {
     // Specs use the existing tutorial Association FK; submissions and stats
     // join by slug because they predate the FK pattern.
     validationSpecs       : Association to many ValidateAnswerSpecs        on validationSpecs.tutorial = $self,
+    validationRules       : Association to many TutorialValidationRules   on validationRules.tutorial = $self,
     validationSubmissions : Association to many ValidateAnswerSubmissions  on validationSubmissions.tutorialSlug = slug,
     codeCheckSpecs        : Association to many CodeCheckSpecs             on codeCheckSpecs.tutorial = $self,
     codeCheckSubmissions  : Association to many CodeCheckSubmissions       on codeCheckSubmissions.tutorialSlug = slug,
@@ -105,9 +108,25 @@ service AdminService {
     virtual mainPreviewLabel : String,
     // Freshness detector (spec 2026-08-22)
     freshnessFindings      : Association to many FreshnessFinding on freshnessFindings.tutorial.ID = ID,
+    freshnessReports       : Association to many FreshnessReport  on freshnessReports.tutorial = $self,
     virtual openHighCount      : Integer,   // populated in after('READ','Tutorials') — Task 8
     virtual freshnessStatus    : String,
     virtual freshnessCriticality : Integer,
+    // Media facet (task-3): object-store images + assets for this tutorial.
+    // Filtered to channel='prod' so the admin OP shows prod-published media.
+    images : Association to many TutorialImages on images.slug = $self.slug and images.channel = 'prod',
+    assets : Association to many TutorialAssets on assets.slug = $self.slug and assets.channel = 'prod',
+    // KG facet (task-1): rank + co-completions associations.
+    // conceptLinks already carried by '*' (db/knowledge-graph.cds extends base.Tutorials).
+    rank          : Association to one  TutorialRank  on rank.slug          = $self.slug,
+    coCompletions : Association to many CoCompletions on coCompletions.sourceSlug = $self.slug,
+    // KG facet (task-2): community membership — links this tutorial to its
+    // Louvain-detected community rows (slug-based join). From the OP, a $expand
+    // on communityMembership exposes communityId + communityFingerprint, which
+    // can be used to fetch the label from KgCommunityLabel. No schema change:
+    // KgCommunityMembers is an @readonly projection on ims.KgCommunity, which
+    // already carries the slug column.
+    communityMembership : Association to many AdminService.KgCommunityMembers on communityMembership.slug = $self.slug,
   };
   // Filtered picklist for redirectTo value help — only ACTIVE tutorials can be redirect targets
   @readonly
@@ -618,6 +637,25 @@ service AdminService {
   @readonly entity CodeCheckSubmissions      as projection on ims.CodeCheckSubmissions;
   @readonly entity AuthorAiRequests          as projection on ims.AuthorAiRequests;
   @readonly entity TutorialCompletionStats   as projection on ims.TutorialCompletionStats;
+  @readonly entity TutorialValidationRules   as projection on ims.TutorialValidationRules;
+
+  // Media facet (task-3): read-only projections of the object-store image and
+  // asset metadata entities. The content Attachments composition auto-exposes
+  // when the parent is reachable from an exposed entity (@cap-js/attachments).
+  @readonly @cds.redirection.target: false entity TutorialImages as projection on ims.TutorialImages {
+    *,
+    // Served-image URLs (filled in after('READ','TutorialImages')): the
+    // tutorial-system's own rendered output, not the GitHub source.
+    // thumbUrl → approuter resize/WebP CDN preview; viewUrl → raw original from CAP.
+    virtual thumbUrl : String,
+    virtual viewUrl  : String
+  };
+  @readonly @cds.redirection.target: false entity TutorialAssets as projection on ims.TutorialAssets;
+
+  // KG facet (task-1): read-only projections used by the Tutorials admin OP KG tab.
+  @readonly @cds.redirection.target: false entity TutorialConceptLinks as projection on ims.TutorialConceptLinks;
+  @readonly @cds.redirection.target: false entity TutorialRank         as projection on ims.TutorialRank;
+  @readonly @cds.redirection.target: false entity CoCompletions        as projection on ims.CoCompletions;
 
   // Issue #622 — read-only recipient list for the "Last Chance Emails"
   // admin section. Powers the dropdown for sendLastChanceEmail and the
@@ -1244,9 +1282,23 @@ extend service AdminService with {
     virtual null as coverageHigh         : Boolean,
   };
 
+  // Human-readable Louvain community label (#1126), keyed by
+  // communityFingerprint. Exposed read-only so the OP membership facet can
+  // surface the LLM-generated cluster name instead of the numeric communityId.
+  @readonly @cds.redirection.target: false
+  entity KgCommunityLabelInfo as projection on ims.KgCommunityLabel;
+
   // OP-facing memberships. Rows keyed to (communityId, vertexKey).
+  // `labelInfo` is an unmanaged select-list association joining to
+  // KgCommunityLabelInfo on the shared communityFingerprint so the facet can
+  // show labelInfo.label (blank until the Louvain labeling job runs in the
+  // target env — member slug is the always-present fallback column).
   @readonly
-  entity KgCommunityMembers as projection on ims.KgCommunity;
+  entity KgCommunityMembers as projection on ims.KgCommunity {
+    *,
+    labelInfo : Association to KgCommunityLabelInfo
+                  on labelInfo.communityFingerprint = communityFingerprint
+  };
 
   // Drafts a Mission from the community's tutorial members, ordered A→Z.
   // Curator finishes the draft in the Missions LR (write description,
diff --git a/srv/admin-service.js b/srv/admin-service.js
index 8e5610965..c6b68ec2a 100644
--- a/srv/admin-service.js
+++ b/srv/admin-service.js
@@ -2195,20 +2195,58 @@ export default class AdminService extends cds.ApplicationService {
       for (const row of list) if (row) row.confidenceCriticality = map[row.confidence] ?? 0;
     });
 
-    // Guard: only SuperAdmin can change the published flag in either direction
-    // (publish OR unpublish). The CREATE exemption permits the runtime's
-    // draft-activation flow, where the activation payload echoes published=false
-    // (the column default per #348) — this is a pass-through, not a change,
-    // so we let regular Admins activate new drafts without elevating.
-    // Any explicit published=true on CREATE is still a change (against the
-    // false default) and requires SuperAdmin. Any PATCH that touches published
-    // is a change against an existing row's value and always requires SuperAdmin.
-    const _guardPublished = (req) => {
-      if (!('published' in req.data)) return;
-      if (req.event === 'CREATE' && req.data.published === false) return;
-      if (!req.user.is('SuperAdmin')) {
-        req.reject(403, 'Only SuperAdmin can change the published state');
+    // Media facet: surface the tutorial-system's own served-image URLs so the
+    // admin OP shows a live preview + a link to the rendered image (not just the
+    // GitHub source). thumbUrl → approuter resize/WebP CDN; viewUrl → raw
+    // original from CAP (self-heals from the object store on a miss). Both are
+    // root-relative so they resolve against the approuter origin serving /admin-ui/.
+    this.after('READ', 'TutorialImages', (rows) => {
+      const list = Array.isArray(rows) ? rows : [rows];
+      for (const row of list) {
+        if (!row || !row.sourceUrl) continue;
+        const u = encodeURIComponent(row.sourceUrl);
+        row.thumbUrl = `/img-cdn?u=${u}`;
+        row.viewUrl = `/content/image-source?u=${u}`;
       }
+    });
+
+    // Guard: only SuperAdmin can CHANGE the published flag in either direction
+    // (publish OR unpublish). The check compares the incoming value against the
+    // currently persisted value — mere *presence* of `published` in the payload
+    // is not a change (#2111). Fiori draft activation echoes the whole entity,
+    // including an unchanged `published: true/false`, so a regular Admin editing
+    // only the title/description must not be rejected.
+    //
+    // CREATE has no prior row: the column default is false (#348), so an echoed
+    // published=false is a no-op the runtime's draft-activation flow emits — let
+    // regular Admins activate new drafts. An explicit published=true on CREATE is
+    // a change against the default and still requires SuperAdmin.
+    const _guardPublished = async (req) => {
+      if (!('published' in req.data)) return;
+      if (req.user.is('SuperAdmin')) return;
+
+      if (req.event === 'CREATE') {
+        if (req.data.published === false) return;
+        return req.reject(403, 'Only SuperAdmin can change the published state');
+      }
+
+      // UPDATE/PATCH (active row or draft): compare against the persisted active
+      // value. Equal → no change → allow. Missing active row (draft never
+      // activated) defaults to the column default (false).
+      const activeName = req.target.name.endsWith('.drafts')
+        ? req.target.name.slice(0, -'.drafts'.length)
+        : req.target.name;
+      const key = req.data.ID
+        ?? (Array.isArray(req.params) && req.params.length
+          ? (req.params[req.params.length - 1]?.ID ?? req.params[req.params.length - 1])
+          : undefined);
+      const current = key
+        ? await SELECT.one.from(activeName).columns('published').where({ ID: key })
+        : null;
+      const currentPublished = current?.published ?? false;
+      if (req.data.published === currentPublished) return;
+
+      req.reject(403, 'Only SuperAdmin can change the published state');
     };
     this.before(['CREATE', 'PATCH'], ['Missions', 'Groups'], _guardPublished);
     this.before('PATCH', ['Missions.drafts', 'Groups.drafts'], _guardPublished);
diff --git a/srv/lib/__tests__/devtoberfest-schedule-check.test.js b/srv/lib/__tests__/devtoberfest-schedule-check.test.js
new file mode 100644
index 000000000..05ee028d9
--- /dev/null
+++ b/srv/lib/__tests__/devtoberfest-schedule-check.test.js
@@ -0,0 +1,209 @@
+// Unit tests for the Devtoberfest schedule-consistency check (issue #2103).
+import { describe, it, expect } from 'vitest';
+import {
+  extractYouTubeVideoId,
+  extractCommunityMessageId,
+  classifyLeg,
+  assembleScheduleCheck,
+  fetchYouTubeScheduledStarts,
+  fetchCommunityStartTimes,
+  buildScheduleCheckReport,
+} from '../devtoberfest-schedule-check.js';
+
+describe('extractYouTubeVideoId', () => {
+  it('parses watch?v= URLs', () => {
+    expect(extractYouTubeVideoId('https://www.youtube.com/watch?v=5u2Z6hR7-28')).toBe('5u2Z6hR7-28');
+  });
+  it('parses watch?v= with extra query params', () => {
+    expect(extractYouTubeVideoId('https://www.youtube.com/watch?v=5u2Z6hR7-28&t=30s&list=abc')).toBe('5u2Z6hR7-28');
+  });
+  it('parses youtu.be short links', () => {
+    expect(extractYouTubeVideoId('https://youtu.be/5u2Z6hR7-28')).toBe('5u2Z6hR7-28');
+  });
+  it('parses /live/ links', () => {
+    expect(extractYouTubeVideoId('https://www.youtube.com/live/5u2Z6hR7-28?feature=share')).toBe('5u2Z6hR7-28');
+  });
+  it('returns null for non-YouTube / empty / malformed', () => {
+    expect(extractYouTubeVideoId('https://zoom.us/j/123')).toBeNull();
+    expect(extractYouTubeVideoId('')).toBeNull();
+    expect(extractYouTubeVideoId(null)).toBeNull();
+    expect(extractYouTubeVideoId('https://www.youtube.com/watch?v=tooShort')).toBeNull();
+  });
+});
+
+describe('extractCommunityMessageId', () => {
+  it('parses ev-p event URLs', () => {
+    expect(extractCommunityMessageId('https://community.sap.com/t5/devtoberfest/intelligent-app/ev-p/14472839')).toBe('14472839');
+  });
+  it('strips query/hash', () => {
+    expect(extractCommunityMessageId('https://community.sap.com/t5/x/ev-p/14472839?foo=1#bar')).toBe('14472839');
+  });
+  it('falls back to a bare trailing numeric segment', () => {
+    expect(extractCommunityMessageId('https://community.sap.com/some/path/14472839/')).toBe('14472839');
+  });
+  it('returns null when no id is present', () => {
+    expect(extractCommunityMessageId('https://community.sap.com/t5/devtoberfest')).toBeNull();
+    expect(extractCommunityMessageId(null)).toBeNull();
+  });
+});
+
+describe('classifyLeg', () => {
+  const planned = '2026-10-09T12:30:00.000Z';
+  it('no-url when the session has no asset URL', () => {
+    expect(classifyLeg(planned, null, { hasUrl: false }).status).toBe('no-url');
+  });
+  it('unknown when URL present but external time unreadable', () => {
+    expect(classifyLeg(planned, null, { hasUrl: true }).status).toBe('unknown');
+    expect(classifyLeg(planned, 'not-a-date', { hasUrl: true }).status).toBe('unknown');
+  });
+  it('no-planner when external known but planner missing', () => {
+    const r = classifyLeg(null, planned, { hasUrl: true });
+    expect(r.status).toBe('no-planner');
+    expect(r.externalStart).toBe(planned);
+  });
+  it('ok within tolerance', () => {
+    // community sample: 14:30+02:00 == 12:30Z — exact match
+    const r = classifyLeg(planned, '2026-10-09T14:30:00.000+02:00', { hasUrl: true, toleranceMinutes: 5 });
+    expect(r.status).toBe('ok');
+    expect(r.deltaMinutes).toBe(0);
+  });
+  it('ok at the tolerance boundary, drift just past it', () => {
+    expect(classifyLeg(planned, '2026-10-09T12:35:00.000Z', { hasUrl: true, toleranceMinutes: 5 }).status).toBe('ok');
+    expect(classifyLeg(planned, '2026-10-09T12:36:00.000Z', { hasUrl: true, toleranceMinutes: 5 }).status).toBe('drift');
+  });
+  it('reports signed delta minutes', () => {
+    expect(classifyLeg(planned, '2026-10-09T13:00:00.000Z', { hasUrl: true }).deltaMinutes).toBe(30);
+    expect(classifyLeg(planned, '2026-10-09T12:00:00.000Z', { hasUrl: true }).deltaMinutes).toBe(-30);
+  });
+});
+
+describe('assembleScheduleCheck', () => {
+  const sessions = [
+    { ID: 's1', SESSIONCODE: 'DT100', TITLE: 'Aligned', SCHEDULEDSTART: '2026-10-09T12:30:00.000Z',
+      YOUTUBEURL: 'https://youtu.be/aaaaaaaaaaa', COMMUNITYEVENTURL: 'https://community.sap.com/t5/x/ev-p/111' },
+    { ID: 's2', SESSIONCODE: 'DT200', TITLE: 'YT drifted', SCHEDULEDSTART: '2026-10-09T12:30:00.000Z',
+      YOUTUBEURL: 'https://www.youtube.com/watch?v=bbbbbbbbbbb', COMMUNITYEVENTURL: null },
+    { ID: 's3', SESSIONCODE: 'DT300', TITLE: 'No URLs', SCHEDULEDSTART: '2026-10-09T12:30:00.000Z',
+      YOUTUBEURL: null, COMMUNITYEVENTURL: null },
+  ];
+  const youtubeStartById = new Map([
+    ['aaaaaaaaaaa', '2026-10-09T12:30:00.000Z'],   // aligned
+    ['bbbbbbbbbbb', '2026-10-09T13:30:00.000Z'],   // +60 min → drift
+  ]);
+  const communityStartById = new Map([
+    ['111', '2026-10-09T12:33:00.000Z'],           // +3 min → ok
+  ]);
+
+  it('classifies each leg and flags drift', () => {
+    const rep = assembleScheduleCheck({ sessions, youtubeStartById, communityStartById, toleranceMinutes: 5 });
+    const [r1, r2, r3] = rep.sessions;
+    expect(r1.youtube.status).toBe('ok');
+    expect(r1.community.status).toBe('ok');
+    expect(r1.hasDrift).toBe(false);
+
+    expect(r2.youtube.status).toBe('drift');
+    expect(r2.youtube.deltaMinutes).toBe(60);
+    expect(r2.community.status).toBe('no-url');
+    expect(r2.hasDrift).toBe(true);
+
+    expect(r3.youtube.status).toBe('no-url');
+    expect(r3.community.status).toBe('no-url');
+    expect(r3.hasDrift).toBe(false);
+  });
+
+  it('summarizes counts', () => {
+    const rep = assembleScheduleCheck({ sessions, youtubeStartById, communityStartById, toleranceMinutes: 5 });
+    expect(rep.summary.total).toBe(3);
+    expect(rep.summary.withDrift).toBe(1);
+    expect(rep.summary.youtube.ok).toBe(1);
+    expect(rep.summary.youtube.drift).toBe(1);
+    expect(rep.summary.youtube['no-url']).toBe(1);
+  });
+
+  it('marks a present-but-unresolved URL as unknown, never drift', () => {
+    const rep = assembleScheduleCheck({
+      sessions: [{ ID: 'x', SCHEDULEDSTART: '2026-10-09T12:30:00.000Z', YOUTUBEURL: 'https://youtu.be/ccccccccccc' }],
+      youtubeStartById: new Map(),  // id not resolved
+      toleranceMinutes: 5,
+    });
+    expect(rep.sessions[0].youtube.status).toBe('unknown');
+    expect(rep.sessions[0].hasDrift).toBe(false);
+  });
+});
+
+describe('fetchYouTubeScheduledStarts', () => {
+  it('returns null for every id when no apiKey', async () => {
+    const map = await fetchYouTubeScheduledStarts(['a', 'b'], { apiKey: '' });
+    expect(map.get('a')).toBeNull();
+    expect(map.get('b')).toBeNull();
+  });
+
+  it('maps scheduledStartTime, null when live details absent or id not returned', async () => {
+    const fetchImpl = async () => ({
+      ok: true,
+      json: async () => ({ items: [
+        { id: 'a', liveStreamingDetails: { scheduledStartTime: '2026-10-09T12:30:00Z' } },
+        { id: 'b', liveStreamingDetails: {} },        // no scheduled time
+        // 'c' not returned at all
+      ] }),
+    });
+    const map = await fetchYouTubeScheduledStarts(['a', 'b', 'c'], { apiKey: 'k', fetchImpl });
+    expect(map.get('a')).toBe('2026-10-09T12:30:00.000Z');
+    expect(map.get('b')).toBeNull();
+    expect(map.get('c')).toBeNull();
+  });
+
+  it('fails soft on non-ok response', async () => {
+    const fetchImpl = async () => ({ ok: false, json: async () => ({}) });
+    const map = await fetchYouTubeScheduledStarts(['a'], { apiKey: 'k', fetchImpl });
+    expect(map.get('a')).toBeNull();
+  });
+
+  it('batches ids into groups of 50', async () => {
+    const calls = [];
+    const fetchImpl = async (url) => { calls.push(url); return { ok: true, json: async () => ({ items: [] }) }; };
+    const ids = Array.from({ length: 120 }, (_, i) => `id${i}`);
+    await fetchYouTubeScheduledStarts(ids, { apiKey: 'k', fetchImpl });
+    expect(calls.length).toBe(3); // 50 + 50 + 20
+  });
+});
+
+describe('fetchCommunityStartTimes', () => {
+  it('maps occasion_data.start_time from a successful LiQL response', async () => {
+    const fetchImpl = async () => ({
+      ok: true,
+      json: async () => ({ status: 'success', data: { items: [
+        { id: '14472839', occasion_data: { start_time: '2026-10-09T14:30:00.000+02:00' } },
+      ] } }),
+    });
+    const map = await fetchCommunityStartTimes(['14472839', '999'], { fetchImpl });
+    expect(map.get('14472839')).toBe('2026-10-09T12:30:00.000Z'); // normalized to UTC
+    expect(map.get('999')).toBeNull();
+  });
+
+  it('fails soft when status is not success', async () => {
+    const fetchImpl = async () => ({ ok: true, json: async () => ({ status: 'error' }) });
+    const map = await fetchCommunityStartTimes(['1'], { fetchImpl });
+    expect(map.get('1')).toBeNull();
+  });
+});
+
+describe('buildScheduleCheckReport (orchestrator)', () => {
+  it('wires both fetchers and assembles a report', async () => {
+    const sessions = [
+      { ID: 's1', SESSIONCODE: 'DT1', SCHEDULEDSTART: '2026-10-09T12:30:00.000Z',
+        YOUTUBEURL: 'https://youtu.be/aaaaaaaaaaa',
+        COMMUNITYEVENTURL: 'https://community.sap.com/t5/x/ev-p/14472839' },
+    ];
+    const fetchImpl = async (url) => {
+      if (url.includes('googleapis.com')) {
+        return { ok: true, json: async () => ({ items: [{ id: 'aaaaaaaaaaa', liveStreamingDetails: { scheduledStartTime: '2026-10-09T12:30:00Z' } }] }) };
+      }
+      return { ok: true, json: async () => ({ status: 'success', data: { items: [{ id: '14472839', occasion_data: { start_time: '2026-10-09T14:30:00.000+02:00' } }] } }) };
+    };
+    const rep = await buildScheduleCheckReport(sessions, { apiKey: 'k', fetchImpl });
+    expect(rep.sessions[0].youtube.status).toBe('ok');
+    expect(rep.sessions[0].community.status).toBe('ok');
+    expect(rep.summary.withDrift).toBe(0);
+  });
+});
diff --git a/srv/lib/attachment-ingest-handler.js b/srv/lib/attachment-ingest-handler.js
index 137acaf36..5fab5e81b 100644
--- a/srv/lib/attachment-ingest-handler.js
+++ b/srv/lib/attachment-ingest-handler.js
@@ -84,7 +84,7 @@ export async function attachmentIngestHandler(req, res) {
         return res.status(200).json({ action: 'unchanged', contentHash })
       }
     }
-    await attachmentStore.put(u, { buffer, mimeType, contentHash, slug, channel, filename })
+    await attachmentStore.put(u, { buffer, mimeType, contentHash, slug, channel, filename, byteSize: buffer.length })
     return res.status(200).json({ action: 'stored', contentHash })
   } catch (err) {
     LOG.error('[attachment-ingest] store put failed for', u, '-', err.message)
diff --git a/srv/lib/attachment-store.cjs b/srv/lib/attachment-store.cjs
index 89e574b1e..0ed1dd025 100644
--- a/srv/lib/attachment-store.cjs
+++ b/srv/lib/attachment-store.cjs
@@ -35,14 +35,15 @@ async function head(sourceUrl) {
   })
 }
 
-async function put(sourceUrl, { buffer, mimeType, contentHash, slug, channel, filename }) {
+async function put(sourceUrl, { buffer, mimeType, contentHash, slug, channel, filename, byteSize }) {
   return withCtx(async () => {
     const { TutorialAssets } = cds.entities('com.sap.developers.ims')
     // delete-then-insert avoids NonUpdatableProperties:[content] 409 on overwrite
     await remove(sourceUrl)
     const parentID = cds.utils.uuid()
     const name = filename || sourceUrl.split('/').pop()
-    await INSERT.into(TutorialAssets).entries({ ID: parentID, sourceUrl, slug, channel, contentHash, mimeType, filename: name })
+    const bs = byteSize != null ? byteSize : (Buffer.isBuffer(buffer) ? buffer.length : null)
+    await INSERT.into(TutorialAssets).entries({ ID: parentID, sourceUrl, slug, channel, contentHash, mimeType, filename: name, byteSize: bs })
     const AttachmentsSrv = await cds.connect.to('attachments')
     await AttachmentsSrv.put(linkedContent(), {
       ID: cds.utils.uuid(),
diff --git a/srv/lib/build-topics.js b/srv/lib/build-topics.js
new file mode 100644
index 000000000..331779244
--- /dev/null
+++ b/srv/lib/build-topics.js
@@ -0,0 +1,30 @@
+// srv/lib/build-topics.js
+import cds from '@sap/cds';
+import { buildTopicsTreePayload, buildTopicDetailPayload } from './topics-query.js';
+
+const log = cds.log('build-topics');
+
+export async function buildTopicsTreeHandler(req, res) {
+  try {
+    const db = await cds.connect.to('db');
+    const payload = await buildTopicsTreePayload(db);
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(payload);
+  } catch (err) {
+    log.error('failed to build /build/topics-tree payload', err);
+    res.status(500).json({ error: 'Build topics query failed' });
+  }
+}
+
+export async function buildTopicDetailHandler(req, res) {
+  try {
+    const db = await cds.connect.to('db');
+    const slug = String(req.params.slug || '').toLowerCase();
+    const payload = await buildTopicDetailPayload(db, slug);
+    res.set('Cache-Control', 'public, max-age=60');
+    res.status(payload.notFound ? 404 : 200).json(payload);
+  } catch (err) {
+    log.error('failed to build /build/topics/:slug payload', err);
+    res.status(500).json({ error: 'Build topic detail query failed' });
+  }
+}
diff --git a/srv/lib/category-classifier.js b/srv/lib/category-classifier.js
index 22f72f979..5f6777bad 100644
--- a/srv/lib/category-classifier.js
+++ b/srv/lib/category-classifier.js
@@ -13,7 +13,11 @@
 
 import cds from '@sap/cds';
 import { getSeedEmbeddings, embedAdHoc } from './category-seed-embeddings.js';
-import { classifyViaLlm } from './category-classifier-llm.js';
+// category-classifier-llm (→ @sap-ai-sdk/orchestration) is imported LAZILY inside the
+// LLM fallback path below. A static import here resolves @sap-ai-sdk/orchestration at
+// module load, which crash-loops the srv-qa container (that package is not installed in
+// the stripped srv-qa deps — only @sap-ai-sdk/foundation-models is). srv-qa never reaches
+// the LLM path, so deferring the import keeps srv-qa boot free of the missing dependency.
 
 const LOG = cds.log('category-classifier');
 
@@ -96,15 +100,22 @@ function pickEmbeddingResult(scored) {
 
 async function persist(kind, itemId, assigned) {
   const cfg = KIND_TO_ENTITY[kind];
+  // Resolve the junction to its namespaced entity object. A bare short-name
+  // string ('TutorialCategories') does NOT resolve to the HANA table
+  // (COM_SAP_DEVELOPERS_IMS_TUTORIALCATEGORIES) when this runs outside a
+  // service handler (e.g. the standalone backfill via `cds bind --exec`) —
+  // it emits bare `TUTORIALCATEGORIES` SQL and dies. loadItemText already
+  // resolves this way, so cds.entities() is known-good by the time we get here.
+  const junction = cds.entities('com.sap.developers.ims')[cfg.junction];
   await cds.tx(async (tx) => {
-    await tx.run(DELETE.from(cfg.junction).where({ [cfg.fk]: itemId }));
+    await tx.run(DELETE.from(junction).where({ [cfg.fk]: itemId }));
     if (assigned.length === 0) return;
     const rows = assigned.map(a => ({
       [cfg.fk]:    itemId,
       category_ID: a.ID,
       score:       a.score ?? 1.0,
     }));
-    await tx.run(INSERT.into(cfg.junction).entries(rows));
+    await tx.run(INSERT.into(junction).entries(rows));
   });
 }
 
@@ -157,6 +168,7 @@ export async function classifyAndPersist(kind, id, _opts = {}) {
   if (!assigned) {
     path = 'llm';
     try {
+      const { classifyViaLlm } = await import('./category-classifier-llm.js');
       const { assigned: llmAssigned } = await classifyViaLlm({
         title:       item.raw.title,
         description: item.raw.description,
diff --git a/srv/lib/category-seed-descriptions-defaults.js b/srv/lib/category-seed-descriptions-defaults.js
new file mode 100644
index 000000000..49c552ced
--- /dev/null
+++ b/srv/lib/category-seed-descriptions-defaults.js
@@ -0,0 +1,65 @@
+// srv/lib/category-seed-descriptions-defaults.js
+//
+// Single source of truth for the baseline Category.seedDescription texts.
+//
+// These paragraphs are what the category classifier EMBEDS and cosine-compares
+// against each tutorial/mission/group's (title + description + primaryTag). They
+// are intentionally keyword-rich and product-named so the embedding path
+// (srv/lib/category-classifier.js) can classify without falling back to the LLM.
+//
+// The Categories reference rows themselves come from
+// db/data/com.sap.developers.ims-Categories.csv (ID/slug/label/sortOrder only —
+// no seedDescription column, so seeds are NOT shipped via CSV; that would
+// full-replace the admin-editable column on every deploy). Instead these are
+// seeded idempotently + non-destructively at boot by
+// ./seed-category-descriptions.js, which fills ONLY rows whose seedDescription
+// is empty — admin edits made at /admin-ui/ are preserved.
+//
+// Keyed by Categories.slug (stable) so a re-ordered/re-IDed CSV can't misalign.
+
+export const CATEGORY_SEED_DESCRIPTIONS = {
+  'app-dev-automation':
+    'Building business applications and extensions with the SAP Cloud Application ' +
+    'Programming Model (CAP), SAP Build and SAP Build Process Automation, low-code and ' +
+    'pro-code development, workflow and business process automation, the ABAP RESTful ' +
+    'Application Programming Model (RAP), side-by-side extensions, SAP Business Application ' +
+    'Studio, and developer tooling for creating, deploying, and automating apps and services.',
+
+  'data-analytics':
+    'Working with data using SAP HANA Cloud, SAP Datasphere, and SAP Analytics Cloud: data ' +
+    'modeling, SQL and calculation views, data federation and replication, business ' +
+    'intelligence, reporting, dashboards, stories, data warehousing, and analytical models.',
+
+  'extended-planning':
+    'Financial and operational planning, budgeting, forecasting, and analysis with SAP ' +
+    'Analytics Cloud planning, SAP Datasphere, and extended planning and analysis (xP&A): ' +
+    'predictive planning, allocations, value driver trees, and enterprise performance management.',
+
+  'integration':
+    'Connecting systems and services with SAP Integration Suite: Cloud Integration, API ' +
+    'Management, Open Connectors, event-driven integration with SAP Event Mesh and Advanced ' +
+    'Event Mesh, EDI and B2B, destinations, connectivity, and integrating SAP with ' +
+    'third-party applications.',
+
+  'artificial-intelligence':
+    'Building intelligent applications with SAP AI Core, the Generative AI Hub, SAP Business ' +
+    'AI, and Joule: machine learning, large language models, embeddings and ' +
+    'retrieval-augmented generation (RAG), document information extraction, orchestration, ' +
+    'and AI-powered automation and copilots.',
+
+  'frontend-ux':
+    'Creating user interfaces and experiences with SAPUI5, SAP Fiori and Fiori Elements, UI5 ' +
+    'Web Components, SAP Build Apps, HTML, CSS and JavaScript, React and Vue front ends, ' +
+    'responsive design, theming, and building engaging developer and end-user experiences.',
+
+  'cloud-operations':
+    'Operating and administering SAP BTP, the Cloud Foundry and Kyma runtimes: deployment ' +
+    'with multitarget applications (MTA), CI/CD pipelines and DevOps, security and ' +
+    'authentication with XSUAA, monitoring, logging and alerting, subaccounts, entitlements, ' +
+    'and cloud lifecycle management.',
+
+  'abap-core':
+    'ABAP programming and ABAP Cloud development: clean core extensibility, SAP S/4HANA and ' +
+    'on-premise systems, RAP and CDS views in ABAP, the ABAP Development Tools (ADT) in ' +
+    'Eclipse, released (tier-1) APIs, and core ERP business logic and data models.',
+};
diff --git a/srv/lib/category-seed-embeddings.js b/srv/lib/category-seed-embeddings.js
index a621ae7ba..4f064ae29 100644
--- a/srv/lib/category-seed-embeddings.js
+++ b/srv/lib/category-seed-embeddings.js
@@ -18,17 +18,35 @@
 
 import cds from '@sap/cds';
 import { embed } from './embedding-client.js';
+import { resolveEmbeddingSettings } from './chat-settings-resolver.js';
 
 const LOG = cds.log('category-seed-embeddings');
 let _cache = null;            // Map<categoryId, Float32Array> | null
 let _stale = new Set();       // IDs marked invalid; recomputed on next getSeedEmbeddings()
 let _loadingPromise = null;   // Promise<Map> | null — in-flight loader
+let _modelPromise = null;     // Promise<string> | null — memoized embedding model name
 
 /** Test-only — resets module state between tests. */
 export function _resetCache() {
   _cache = null;
   _stale = new Set();
   _loadingPromise = null;
+  _modelPromise = null;
+}
+
+/**
+ * Resolve (once, memoized) the embedding model name. embed() REQUIRES a model
+ * — passing undefined constructs AzureOpenAiEmbeddingClient(undefined), which
+ * throws "Cannot read properties of undefined (reading 'modelName')" (the
+ * #2001 class of bug: embed callers must pass a resolved model). The model
+ * rarely changes; memoize so a bulk backfill (thousands of embedAdHoc calls)
+ * doesn't re-read ChatSettings per item. Cleared by _resetCache() in tests.
+ */
+function getEmbeddingModel() {
+  if (!_modelPromise) {
+    _modelPromise = resolveEmbeddingSettings().then((s) => s.model);
+  }
+  return _modelPromise;
 }
 
 /**
@@ -44,7 +62,7 @@ async function loadAll() {
     LOG.warn('No categories with seedDescription found — classifier will fall back to LLM for everything');
     return new Map();
   }
-  const vectors = await embed(usable.map(r => r.seedDescription));
+  const vectors = await embed(usable.map(r => r.seedDescription), await getEmbeddingModel());
   const m = new Map();
   for (let i = 0; i < usable.length; i++) {
     m.set(usable[i].ID, vectors[i]);
@@ -69,7 +87,7 @@ async function recomputeStale(staleIds) {
   const rows = await SELECT.from(Categories).columns('ID', 'seedDescription');
   const targets = rows.filter(r => staleIds.has(r.ID) && r.seedDescription && r.seedDescription.trim().length > 0);
   if (targets.length === 0) return;
-  const vectors = await embed(targets.map(r => r.seedDescription));
+  const vectors = await embed(targets.map(r => r.seedDescription), await getEmbeddingModel());
   for (let i = 0; i < targets.length; i++) {
     _cache.set(targets[i].ID, vectors[i]);
   }
@@ -142,6 +160,6 @@ export async function embedAdHoc(text) {
   if (!text || !text.trim()) {
     throw new Error('embedAdHoc: empty text');
   }
-  const [vec] = await embed([text]);
+  const [vec] = await embed([text], await getEmbeddingModel());
   return vec;
 }
diff --git a/srv/lib/chrome-shell.js b/srv/lib/chrome-shell.js
index fb1f51aa6..020f7d380 100644
--- a/srv/lib/chrome-shell.js
+++ b/srv/lib/chrome-shell.js
@@ -84,6 +84,9 @@ export function canonicalUrlFor(meta) {
     case 'puzzle':         return `${CANONICAL_ORIGIN}/puzzles/${slug}/`;
     // #1914 follow-up: the /puzzles/ section index (also CAP-served).
     case 'puzzles-index':  return `${CANONICAL_ORIGIN}/puzzles/`;
+    // tag-tree-topics: topics section index and individual topic pages.
+    case 'topics-index':   return `${CANONICAL_ORIGIN}/topics/`;
+    case 'topic':          return `${CANONICAL_ORIGIN}/topics/${slug}/`;
     default:               return null;
   }
 }
@@ -123,6 +126,14 @@ export function buildBreadcrumbJsonLd(meta, canonicalUrl) {
     case 'puzzles-index':
       crumbs.push({ name: 'Puzzles', item: `${CANONICAL_ORIGIN}/puzzles/` });
       break;
+    // tag-tree-topics: topics section index and individual topic pages.
+    case 'topics-index':
+      crumbs.push({ name: 'Topics', item: `${CANONICAL_ORIGIN}/topics/` });
+      break;
+    case 'topic':
+      crumbs.push({ name: 'Topics', item: `${CANONICAL_ORIGIN}/topics/` });
+      crumbs.push({ name: leaf, item: canonicalUrl });
+      break;
     default:
       return null;
   }
diff --git a/srv/lib/content-publish-session.js b/srv/lib/content-publish-session.js
index ce3b12bfd..79ef5dd96 100644
--- a/srv/lib/content-publish-session.js
+++ b/srv/lib/content-publish-session.js
@@ -11,6 +11,39 @@ import { tutorialsTableInfo } from './_tutorials-table.js';
 import { logPipelineStart, logPipelineEnd, logPipelineItem } from './pipeline-log.js';
 import { resolveTutorialAuthor } from './resolve-tutorial-author.js';
 import { isDeltaWrite, isDeltaSkipCarryForward } from './content-delta-flags.js';
+import { classifyAndPersist } from './category-classifier.js';
+
+// Incremental publishes above this many touched tutorials are treated as "bulk"
+// and skip the fire-and-forget self-heal (categories are (re)populated in bulk by
+// scripts/backfill-categories.cjs instead). Rationale: a full rebuild touches
+// ~all tutorials; firing an unbounded classification per tutorial (each does an
+// AI-Core embedding call) OOM-killed tutorials-srv mid-publish. See memory
+// srv-category-selfheal-bulk-publish-oom.
+const SELF_HEAL_MAX_TUTORIALS = 25;
+
+// Exported for unit testing; classifies touched tutorials without ever throwing
+// into the publish tx (publish bypasses the CAP after('CREATE') classifier hook).
+// Bulk publishes are skipped (backfill script handles them); incremental publishes
+// classify SEQUENTIALLY — never a fan-out Promise.all — so the classifier can't
+// stampede the srv / AI Core during a publish.
+export async function classifyTouchedTutorials(tutorialIds) {
+  const ids = tutorialIds || [];
+  if (ids.length === 0) return;
+  if (ids.length > SELF_HEAL_MAX_TUTORIALS) {
+    console.warn(
+      `[publish] category self-heal skipped for bulk publish (${ids.length} tutorials > ${SELF_HEAL_MAX_TUTORIALS}); ` +
+        `run scripts/backfill-categories.cjs to (re)classify in bulk`,
+    );
+    return;
+  }
+  for (const id of ids) {
+    try {
+      await classifyAndPersist('tutorial', id);
+    } catch (e) {
+      console.warn('[publish] category classify skipped', id, e?.message);
+    }
+  }
+}
 
 const LOG = cds.log('content-publish');
 const LOCK_NAME = 'content-publish';
@@ -208,6 +241,8 @@ export function createSessionHelpers({ namespace }) {
       } catch (err) {
         LOG.warn('linkTutorialAuthorship failed; skipping', err);
       }
+      // Fire-and-forget: keep categories populated for publish-created tutorials.
+      classifyTouchedTutorials(tutorialIds);
     }
     if (Object.keys(bodyTexts).length > 0) {
       await upsertBodyTexts(namespace, bodyTexts);
diff --git a/srv/lib/contributors-publish.js b/srv/lib/contributors-publish.js
new file mode 100644
index 000000000..60a576505
--- /dev/null
+++ b/srv/lib/contributors-publish.js
@@ -0,0 +1,80 @@
+// srv/lib/contributors-publish.js
+// Handler for POST /content/publish-contributors.
+//
+// Bearer auth is delegated to `contentAuthMiddleware` from
+// srv/lib/content-store.js — same shape as /content/validate-answer-specs
+// and /content/code-check-specs: 503 when CONTENT_API_KEY is unset,
+// 401 on missing Bearer header, 403 on wrong key, with timing-safe comparison.
+// This handler runs ONLY after auth has succeeded.
+//
+// Accepts `{ slug, contributors: [{login,name,email,avatarUrl}] }` and
+// REPLACE-per-slug: DELETEs all TutorialContributors rows for that tutorial
+// then INSERTs the new set atomically inside cds.tx(). Publishing slug A
+// never touches slug B's rows.
+
+import cds from '@sap/cds'
+
+const NS = 'com.sap.developers.ims'
+
+export function githubProfileUrl(login) {
+  return login ? `https://github.com/${login}` : null
+}
+
+/**
+ * Core, unit-testable: REPLACE all contributor rows for one slug.
+ * @param {object} db  – connected CDS db service (cds.connect.to('db'))
+ * @param {string} slug – tutorial slug (case-insensitive)
+ * @param {Array}  contributors – array of {login,name,email,avatarUrl}
+ */
+export async function replaceContributorsForSlug(db, slug, contributors) {
+  const { Tutorials, TutorialContributors } = cds.entities(NS)
+  const lcSlug = String(slug || '').toLowerCase()
+  const tut = await db.run(SELECT.one.from(Tutorials).columns('ID').where({ slug: lcSlug }))
+  if (!tut) return { ok: false, reason: 'tutorial_not_found', slug: lcSlug }
+
+  const entries = (contributors || [])
+    .filter((c) => c && (c.login || c.name || c.email))
+    .slice(0, 10)
+    .map((c) => ({
+      ID: cds.utils.uuid(),
+      tutorial_ID: tut.ID,
+      login: (c.login || '').slice(0, 255),
+      name: (c.name || '').slice(0, 255),
+      email: (c.email || '').slice(0, 255),
+      avatarUrl: (c.avatarUrl || '').slice(0, 1024),
+      profileUrl: githubProfileUrl(c.login),
+    }))
+
+  await cds.tx(async (tx) => {
+    await tx.run(DELETE.from(TutorialContributors).where({ tutorial_ID: tut.ID }))
+    if (entries.length) await tx.run(INSERT.into(TutorialContributors).entries(entries))
+  })
+  return { ok: true, slug: lcSlug, count: entries.length }
+}
+
+/**
+ * Express handler mirroring the validate-answer-specs route shape.
+ * Mounted in server.js with contentAuthMiddleware + express.json().
+ */
+export async function publishContributors(req, res) {
+  try {
+    const { slug, contributors } = req.body || {}
+    if (!slug || !Array.isArray(contributors)) {
+      return res.status(400).json({ error: 'bad_request', detail: 'expected { slug, contributors[] }' })
+    }
+
+    // entity_not_in_model guard (QA namespace safety — mirrors validate-answer-spec-publish.js).
+    let entities
+    try { entities = cds.entities(NS) } catch { entities = null }
+    if (!entities || !entities.TutorialContributors) {
+      return res.status(409).json({ error: 'entity_not_in_model' })
+    }
+
+    const db = await cds.connect.to('db')
+    const result = await replaceContributorsForSlug(db, slug, contributors)
+    if (!result.ok) return res.status(404).json(result)
+    return res.json(result)
+  } catch (e) {
+    return res.status(500).json({ error: 'internal', detail: e?.message })
+  }
+}
diff --git a/srv/lib/devtoberfest-feed.js b/srv/lib/devtoberfest-feed.js
index 348dd33a7..7cdab5b92 100644
--- a/srv/lib/devtoberfest-feed.js
+++ b/srv/lib/devtoberfest-feed.js
@@ -11,6 +11,17 @@ function isVisibleStatus(row) {
   return VISIBLE_STATUSES.has(s);
 }
 
+// Normalize the free-text facade BROADCASTINGPREFERENCE (String(5000)) to a
+// stable canonical token the views can key off. Observed planner values are
+// 'Live' and 'PreRecorded'; anything empty/unrecognized fails to null (no tag,
+// excluded from Live/PreRecorded filters) so casing/whitespace drift is safe.
+function normalizeBroadcastingPreference(raw) {
+  const v = (raw ?? '').trim().toLowerCase();
+  if (v === 'live') return 'Live';
+  if (v === 'prerecorded' || v === 'pre-recorded') return 'PreRecorded';
+  return null;
+}
+
 function normalizeSlugSet(rows) {
   const set = new Set();
   for (const r of rows || []) {
@@ -51,6 +62,7 @@ function assembleFeed({ sessions = [], activities = [], tracks = [], editions =
         trackColor: mapTrack(s.TRACK_ID).COLOR || '', trackEmoji: mapTrack(s.TRACK_ID).EMOJI || '',
         week: s.WEEK, scheduledStart: s.SCHEDULEDSTART, scheduledTimeZone: s.SCHEDULEDTIMEZONE, recordingStart: s.RECORDINGSTART,
         sessionLength: s.SESSIONLENGTH || '',
+        broadcastingPreference: normalizeBroadcastingPreference(s.BROADCASTINGPREFERENCE),
         youtubeUrl: s.YOUTUBEURL || '', communityEventUrl: s.COMMUNITYEVENTURL || '',
         linkedinUrl: s.LINKEDINURL || '',
         speakers: speakerFor(s.ID),
@@ -110,4 +122,4 @@ function sortByWeekThenTitle(a, b) {
   return w !== 0 ? w : String(a.title || '').localeCompare(String(b.title || ''));
 }
 
-export { assembleFeed, completedActivityPoints, normalizeSlugSet, filterCompletionsWithinWindow, isVisibleStatus };
+export { assembleFeed, completedActivityPoints, normalizeSlugSet, normalizeBroadcastingPreference, filterCompletionsWithinWindow, isVisibleStatus };
diff --git a/srv/lib/devtoberfest-schedule-check.js b/srv/lib/devtoberfest-schedule-check.js
new file mode 100644
index 000000000..9eea7d869
--- /dev/null
+++ b/srv/lib/devtoberfest-schedule-check.js
@@ -0,0 +1,234 @@
+// srv/lib/devtoberfest-schedule-check.js
+//
+// Schedule-consistency check for Devtoberfest sessions (issue #2103).
+//
+// The planner's `Session.SCHEDULEDSTART` is the source of truth for when a
+// session runs. The *actual* scheduled times on the external assets — the
+// YouTube livestream and the community.sap.com event — are set separately by
+// humans and can drift. This module reconciles them: for each session it reads
+// the external start times and flags any that disagree with SCHEDULEDSTART.
+//
+// Two external legs are readable deterministically (verified against live data,
+// issue #2103):
+//   - YouTube:   videos?part=liveStreamingDetails → scheduledStartTime, keyed by
+//                the video id parsed from Session.YOUTUBEURL. Needs YOUTUBE_API_KEY.
+//   - community: the Khoros LiQL API (community.sap.com/api/2.0/search) exposes
+//                occasion_data.start_time keyed by the message id in
+//                Session.COMMUNITYEVENTURL.
+//
+// Zoom is intentionally NOT checked: the planner has no readable Zoom start time
+// (ZOOMURL is a bare join link, CALENDARINVITE is empty across all rows, and
+// ZOOMINVITEDETAILS is free-text notes — see the #2103 probe).
+//
+// Pure helpers (parsing + comparison + assembly) carry no cds/db/network access
+// so they are trivially unit-testable; the two fetchers take an injectable
+// `fetchImpl` seam. Everything fails soft — a leg we cannot read reports
+// 'unknown', never a spurious 'drift'.
+
+const YT_API_BASE = 'https://www.googleapis.com/youtube/v3';
+const KHOROS_API = 'https://community.sap.com/api/2.0/search';
+const YT_BATCH = 50;        // videos?id= accepts up to 50 comma-separated ids
+const KHOROS_BATCH = 50;
+const DEFAULT_TOLERANCE_MIN = 5;
+const FETCH_TIMEOUT_MS = 8000;
+
+// --- Pure parsers -----------------------------------------------------------
+
+// Extract the 11-char YouTube video id from any of the URL shapes the planner
+// stores: watch?v=ID, youtu.be/ID, /live/ID, /embed/ID, /shorts/ID. Returns the
+// id or null (unparseable / not a YouTube URL).
+export function extractYouTubeVideoId(url) {
+  if (!url || typeof url !== 'string') return null;
+  const s = url.trim();
+  // watch?v=... (also catches &v= and generic v= query param)
+  const q = /[?&]v=([A-Za-z0-9_-]{11})(?:[&#]|$)/.exec(s);
+  if (q) return q[1];
+  // youtu.be/ID , /live/ID , /embed/ID , /shorts/ID , /v/ID
+  const p = /(?:youtu\.be\/|\/live\/|\/embed\/|\/shorts\/|\/v\/)([A-Za-z0-9_-]{11})(?:[?&#/]|$)/.exec(s);
+  if (p) return p[1];
+  return null;
+}
+
+// Extract the numeric Khoros message id from a community.sap.com event URL.
+// Event pages end in `.../ev-p/<id>` (or occasionally a bare trailing numeric
+// segment). Returns the id string or null.
+export function extractCommunityMessageId(url) {
+  if (!url || typeof url !== 'string') return null;
+  const s = url.trim().split(/[?#]/)[0];
+  const m = /(?:ev-p|td-p|m-p|bc-p)\/(\d+)\b/.exec(s);
+  if (m) return m[1];
+  const tail = /\/(\d{4,})\/?$/.exec(s);
+  return tail ? tail[1] : null;
+}
+
+// --- Pure comparison --------------------------------------------------------
+
+// Compare a planner time to an external time. Returns { status, deltaMinutes,
+// externalStart }. Statuses:
+//   'no-url'      — the session has no URL for this asset (not applicable)
+//   'unknown'     — URL present but the external time could not be read
+//   'no-planner'  — external time read, but SCHEDULEDSTART is missing
+//   'ok'          — both known and within tolerance
+//   'drift'       — both known and further apart than tolerance
+// `hasUrl` distinguishes 'no-url' from 'unknown' (a present-but-unreadable URL).
+export function classifyLeg(plannedStart, externalStart, { hasUrl = true, toleranceMinutes = DEFAULT_TOLERANCE_MIN } = {}) {
+  if (!hasUrl) return { status: 'no-url', deltaMinutes: null, externalStart: null };
+  const extMs = toMs(externalStart);
+  if (extMs == null) return { status: 'unknown', deltaMinutes: null, externalStart: null };
+  const plMs = toMs(plannedStart);
+  if (plMs == null) return { status: 'no-planner', deltaMinutes: null, externalStart: isoOrNull(externalStart) };
+  const deltaMinutes = Math.round((extMs - plMs) / 60000);
+  const status = Math.abs(deltaMinutes) <= toleranceMinutes ? 'ok' : 'drift';
+  return { status, deltaMinutes, externalStart: isoOrNull(externalStart) };
+}
+
+function toMs(value) {
+  if (value == null || value === '') return null;
+  const d = value instanceof Date ? value : new Date(value);
+  const ms = d.getTime();
+  return Number.isNaN(ms) ? null : ms;
+}
+
+function isoOrNull(value) {
+  const ms = toMs(value);
+  return ms == null ? null : new Date(ms).toISOString();
+}
+
+// --- Pure assembly ----------------------------------------------------------
+
+// Build the report from planner sessions plus already-fetched external time
+// maps. Keeps zero I/O so the whole comparison is unit-testable.
+//
+//   sessions           : [{ ID, SESSIONCODE, TITLE, SCHEDULEDSTART, YOUTUBEURL, COMMUNITYEVENTURL }]
+//   youtubeStartById   : Map<videoId, isoString|null>
+//   communityStartById : Map<messageId, isoString|null>
+//
+// Returns { toleranceMinutes, sessions: [...rows], summary: {...counts} }.
+export function assembleScheduleCheck({ sessions = [], youtubeStartById = new Map(), communityStartById = new Map(), toleranceMinutes = DEFAULT_TOLERANCE_MIN } = {}) {
+  const rows = sessions.map((s) => {
+    const planned = s.SCHEDULEDSTART ?? null;
+
+    const ytId = extractYouTubeVideoId(s.YOUTUBEURL);
+    const ytExternal = ytId ? (youtubeStartById.get(ytId) ?? null) : null;
+    const youtube = {
+      ...classifyLeg(planned, ytExternal, { hasUrl: !!s.YOUTUBEURL, toleranceMinutes }),
+      videoId: ytId,
+      url: s.YOUTUBEURL || null,
+    };
+
+    const commId = extractCommunityMessageId(s.COMMUNITYEVENTURL);
+    const commExternal = commId ? (communityStartById.get(commId) ?? null) : null;
+    const community = {
+      ...classifyLeg(planned, commExternal, { hasUrl: !!s.COMMUNITYEVENTURL, toleranceMinutes }),
+      messageId: commId,
+      url: s.COMMUNITYEVENTURL || null,
+    };
+
+    const hasDrift = youtube.status === 'drift' || community.status === 'drift';
+    return {
+      id: s.ID,
+      sessionCode: s.SESSIONCODE || null,
+      title: s.TITLE || null,
+      scheduledStart: isoOrNull(planned),
+      hasDrift,
+      youtube,
+      community,
+    };
+  });
+
+  const summary = {
+    total: rows.length,
+    withDrift: rows.filter((r) => r.hasDrift).length,
+    youtube: countStatuses(rows.map((r) => r.youtube.status)),
+    community: countStatuses(rows.map((r) => r.community.status)),
+  };
+  return { toleranceMinutes, sessions: rows, summary };
+}
+
+function countStatuses(statuses) {
+  const out = { ok: 0, drift: 0, unknown: 0, 'no-url': 0, 'no-planner': 0 };
+  for (const s of statuses) out[s] = (out[s] || 0) + 1;
+  return out;
+}
+
+// --- Fetchers (I/O, injectable seam) ---------------------------------------
+
+async function fetchJson(url, { fetchImpl, timeoutMs = FETCH_TIMEOUT_MS, headers } = {}) {
+  const f = fetchImpl || globalThis.fetch;
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await f(url, { headers, signal: controller.signal });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+function chunk(arr, size) {
+  const out = [];
+  for (let i = 0; i < arr.length; i += size) out.push(arr.slice(i, i + size));
+  return out;
+}
+
+// Resolve YouTube livestream scheduled start times for the given video ids.
+// Returns Map<videoId, isoString|null>. Every requested id is present in the
+// map (null when the video has no live-streaming details, is private, or was
+// not returned). Fails soft: an API/network error yields null for that batch.
+export async function fetchYouTubeScheduledStarts(videoIds, { apiKey, fetchImpl, timeoutMs } = {}) {
+  const ids = [...new Set((videoIds || []).filter(Boolean))];
+  const map = new Map(ids.map((id) => [id, null]));
+  if (!ids.length || !apiKey) return map;
+  for (const batch of chunk(ids, YT_BATCH)) {
+    const url = `${YT_API_BASE}/videos?part=liveStreamingDetails&id=${encodeURIComponent(batch.join(','))}&key=${encodeURIComponent(apiKey)}`;
+    const json = await fetchJson(url, { fetchImpl, timeoutMs });
+    for (const item of json?.items || []) {
+      const start = item?.liveStreamingDetails?.scheduledStartTime || null;
+      if (item?.id) map.set(item.id, start ? isoOrNull(start) : null);
+    }
+  }
+  return map;
+}
+
+// Resolve community.sap.com event start times for the given Khoros message ids
+// via the LiQL search API. Returns Map<messageId, isoString|null>. Fails soft.
+export async function fetchCommunityStartTimes(messageIds, { fetchImpl, timeoutMs } = {}) {
+  const ids = [...new Set((messageIds || []).filter(Boolean).map(String))];
+  const map = new Map(ids.map((id) => [id, null]));
+  if (!ids.length) return map;
+  for (const batch of chunk(ids, KHOROS_BATCH)) {
+    const inList = batch.map((id) => `'${id}'`).join(',');
+    const liql = `SELECT id,occasion_data.start_time FROM messages WHERE id IN (${inList})`;
+    const url = `${KHOROS_API}?q=${encodeURIComponent(liql)}`;
+    const json = await fetchJson(url, {
+      fetchImpl,
+      timeoutMs,
+      headers: { Accept: 'application/json', 'User-Agent': 'Mozilla/5.0 (compatible; sap-tutorials/1.0)' },
+    });
+    if (json?.status !== 'success') continue;
+    for (const item of json?.data?.items || []) {
+      const start = item?.occasion_data?.start_time || null;
+      if (item?.id != null) map.set(String(item.id), start ? isoOrNull(start) : null);
+    }
+  }
+  return map;
+}
+
+// --- Orchestrator -----------------------------------------------------------
+
+// Fetch both external legs for the given planner sessions and assemble the
+// report. Pure-assembly + I/O split so the route stays thin.
+export async function buildScheduleCheckReport(sessions, { apiKey, fetchImpl, toleranceMinutes = DEFAULT_TOLERANCE_MIN } = {}) {
+  const videoIds = sessions.map((s) => extractYouTubeVideoId(s.YOUTUBEURL)).filter(Boolean);
+  const messageIds = sessions.map((s) => extractCommunityMessageId(s.COMMUNITYEVENTURL)).filter(Boolean);
+  const [youtubeStartById, communityStartById] = await Promise.all([
+    fetchYouTubeScheduledStarts(videoIds, { apiKey, fetchImpl }),
+    fetchCommunityStartTimes(messageIds, { fetchImpl }),
+  ]);
+  return assembleScheduleCheck({ sessions, youtubeStartById, communityStartById, toleranceMinutes });
+}
+
+export const _internals = { DEFAULT_TOLERANCE_MIN, YT_BATCH, KHOROS_BATCH };
diff --git a/srv/lib/image-ingest-handler.js b/srv/lib/image-ingest-handler.js
index 04683e29a..6f7bff8db 100644
--- a/srv/lib/image-ingest-handler.js
+++ b/srv/lib/image-ingest-handler.js
@@ -74,7 +74,7 @@ export async function imageIngestHandler(req, res) {
         return res.status(200).json({ action: 'unchanged', contentHash })
       }
     }
-    await imageStore.put(u, { buffer, mimeType, contentHash, slug, channel })
+    await imageStore.put(u, { buffer, mimeType, contentHash, slug, channel, byteSize: buffer.length })
     return res.status(200).json({ action: 'stored', contentHash })
   } catch (err) {
     LOG.error('[image-ingest] store put failed for', u, '-', err.message)
diff --git a/srv/lib/image-store.cjs b/srv/lib/image-store.cjs
index ce18ca779..34a092bfc 100644
--- a/srv/lib/image-store.cjs
+++ b/srv/lib/image-store.cjs
@@ -37,13 +37,14 @@ async function head(sourceUrl) {
   })
 }
 
-async function put(sourceUrl, { buffer, mimeType, contentHash, slug, channel }) {
+async function put(sourceUrl, { buffer, mimeType, contentHash, slug, channel, byteSize }) {
   return withCtx(async () => {
     const { TutorialImages } = cds.entities('com.sap.developers.ims')
     // R5: delete-then-insert avoids the NonUpdatableProperties:[content] 409 on overwrite
     await remove(sourceUrl)
     const parentID = cds.utils.uuid()
-    await INSERT.into(TutorialImages).entries({ ID: parentID, sourceUrl, slug, channel, contentHash, mimeType })
+    const bs = byteSize != null ? byteSize : (Buffer.isBuffer(buffer) ? buffer.length : null)
+    await INSERT.into(TutorialImages).entries({ ID: parentID, sourceUrl, slug, channel, contentHash, mimeType, byteSize: bs })
     const AttachmentsSrv = await cds.connect.to('attachments')
     await AttachmentsSrv.put(linkedContent(), {
       ID: cds.utils.uuid(),
diff --git a/srv/lib/page-key-map.js b/srv/lib/page-key-map.js
index 4d6025cce..c3e822463 100644
--- a/srv/lib/page-key-map.js
+++ b/srv/lib/page-key-map.js
@@ -22,7 +22,6 @@ export function extForMime(mimeType) {
 export const IN_SCOPE_PAGES = [
   { route: '/',                      key: 'page-index',               file: 'index.html',                mimeType: 'text/html' },
   { route: '/browse/',               key: 'page-browse',              file: 'browse/index.html',         mimeType: 'text/html' },
-  { route: '/topics/',               key: 'page-topics',              file: 'topics/index.html',         mimeType: 'text/html' },
   { route: '/tutorial-navigator/',   key: 'page-tutorial-navigator',  file: 'tutorial-navigator/index.html', mimeType: 'text/html' },
   { route: '/developer-advocates/',  key: 'page-developer-advocates', file: 'developer-advocates/index.html', mimeType: 'text/html' },
   { route: '/devtoberfest/',         key: 'page-devtoberfest',        file: 'devtoberfest/index.html',   mimeType: 'text/html' },
diff --git a/srv/lib/publish-topics.js b/srv/lib/publish-topics.js
new file mode 100644
index 000000000..d4bf95db7
--- /dev/null
+++ b/srv/lib/publish-topics.js
@@ -0,0 +1,174 @@
+// srv/lib/publish-topics.js
+//
+// Task 6 of the tag-tree-topics plan. A session-scoped publish phase that
+// renders every live topic tag and appends `topic-<slug>` BLOBs to an open
+// publish session. Each BLOB is a FULL HTML document: the topic BODY
+// (renderTopicDetail) composed into the __shell__ chrome via composeShell,
+// mirroring the same pattern used by publish-concepts.js for concept pages.
+//
+// Dark launch: no publish-content.ts caller yet (Task 7 wires it).
+
+import cds from '@sap/cds';
+import { gzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+import { loadLiveTags, buildTopicDetailPayload, loadTopicCorpus } from './topics-query.js';
+import { renderTopicDetail } from './topic-detail-render.js';
+import { composeShell, createShellLoader } from './chrome-shell.js';
+import { createSessionHelpers } from './content-publish-session.js';
+import * as metrics from './metrics.js';
+
+const DEFAULT_NAMESPACE = 'com.sap.developers.ims';
+const BATCH_SIZE = 20;
+const MAX_ERROR_RATE = 0.05; // >5% of topics erroring aborts the phase
+
+const META_DESC_MAX = 160; // Google truncates around 155–160 chars.
+
+export function topicMetaDescription(topic) {
+  const n = topic.tutorials?.length ?? 0;
+  const c = topic.concepts?.length ?? 0;
+  return `${topic.label}: ${n} tutorial${n === 1 ? '' : 's'} and ${c} concept${c === 1 ? '' : 's'} on developers.sap.com.`.slice(0, META_DESC_MAX);
+}
+
+/**
+ * Render every live topic into an open publish session.
+ *
+ * @param {object} args
+ * @param {object} args.db           CDS db service (passed to loadLiveTags / buildTopicDetailPayload).
+ * @param {string} args.sessionId    Open publish session id.
+ * @param {object} args.helpers      { appendToSession } (from createSessionHelpers).
+ * @param {object} args.priorHashes  Map of `topic-<slug>` → prior stored
+ *                                    contentHash (full-doc sha256) for delta skip.
+ * @param {{before:string,after:string}} args.shell  Parsed __shell__ halves.
+ * @param {object} [args.deps]       { loadLiveTags, buildTopicDetailPayload, loadTopicCorpus } — defaults to real.
+ * @returns {Promise<{topicsSeen,topicsChanged,topicsSkipped,topicsErrored,durationMs}>}
+ */
+export async function renderTopicsIntoSession({ db, sessionId, helpers, priorHashes = {}, shell, deps = {} }) {
+  const started = Date.now();
+  if (!shell || typeof shell.before !== 'string' || typeof shell.after !== 'string') {
+    throw new Error('render-topics: shell unavailable — __shell__ sidecar not yet published');
+  }
+  const _loadLiveTags = deps.loadLiveTags || loadLiveTags;
+  const _buildTopicDetailPayload = deps.buildTopicDetailPayload || buildTopicDetailPayload;
+  const _loadTopicCorpus = deps.loadTopicCorpus || loadTopicCorpus;
+
+  // Load the full corpus ONCE before the loop — avoids O(topics × full-corpus)
+  // redundant DB reads. The serve path (srv/server.js) calls buildTopicDetailPayload
+  // with only 2 args, so the corpus-free path remains intact for single-slug lookups.
+  const corpus = await _loadTopicCorpus(db);
+  const live = corpus.live;
+  const topicsSeen = live.length;
+
+  // Render + delta-filter into a flat file map first, so we can enforce the
+  // error threshold before writing anything.
+  const changedFiles = {}; // key → base64(gzip(full doc))
+  let topicsSkipped = 0;
+  let topicsErrored = 0;
+
+  for (const tag of live) {
+    const key = `topic-${tag.slug}`;
+    try {
+      const topic = await _buildTopicDetailPayload(db, tag.slug, corpus);
+      if (topic.notFound || topic.error) {
+        topicsErrored++;
+        metrics.counter('topic_render_error');
+        console.error(`[render-topics] topic "${tag.slug}" payload returned error/notFound`);
+        continue;
+      }
+      const { body } = renderTopicDetail(topic);
+      const meta = {
+        kind: 'topic',
+        slug: topic.slug,
+        title: topic.label,
+        description: topicMetaDescription(topic),
+      };
+      const fullDoc = composeShell(shell, body, meta);
+      const contentHash = createHash('sha256').update(fullDoc, 'utf-8').digest('hex');
+      if (priorHashes[key] === contentHash) {
+        topicsSkipped++;
+        continue;
+      }
+      changedFiles[key] = gzipSync(Buffer.from(fullDoc, 'utf-8')).toString('base64');
+    } catch (err) {
+      topicsErrored++;
+      metrics.counter('topic_render_error');
+      console.error(`[render-topics] topic "${tag.slug}" render failed — carrying forward prior BLOB: ${err.message}`);
+    }
+  }
+
+  // Corrupt-run guard: if a large fraction of topics errored, abort so the
+  // caller can roll the session back rather than commit a degraded corpus.
+  if (topicsSeen > 0 && topicsErrored / topicsSeen > MAX_ERROR_RATE) {
+    throw new Error(`render-topics: error rate too high (${topicsErrored}/${topicsSeen}) — aborting phase`);
+  }
+
+  // Append in batches of BATCH_SIZE.
+  const keys = Object.keys(changedFiles);
+  for (let i = 0; i < keys.length; i += BATCH_SIZE) {
+    const slice = keys.slice(i, i + BATCH_SIZE);
+    const files = {};
+    for (const k of slice) files[k] = changedFiles[k];
+    await helpers.appendToSession({ sessionId, files });
+  }
+
+  const durationMs = Date.now() - started;
+  const topicsChanged = keys.length;
+  metrics.observe('topic_render_ms', durationMs);
+  metrics.counter('topics_rendered_total', topicsChanged);
+  metrics.counter('topics_skipped_total', topicsSkipped);
+  return { topicsSeen, topicsChanged, topicsSkipped, topicsErrored, durationMs };
+}
+
+/**
+ * Express handler factory for POST /content/publish/render-topics. Bound to
+ * a namespace; owns getActiveVersion + shellLoader + prior-hash lookup.
+ */
+export function createRenderTopics({ namespace = DEFAULT_NAMESPACE } = {}) {
+  const hanaTableName = () => `${namespace.replace(/\./g, '_').toUpperCase()}_CONTENTFILES`;
+
+  async function getActiveVersion() {
+    const { ContentManifest } = cds.entities(namespace);
+    const [row] = await SELECT.from(ContentManifest).where({ status: 'ACTIVE' }).columns('version');
+    return row?.version ?? null;
+  }
+
+  const shellLoader = createShellLoader({ namespace, hanaTableName, getActiveVersion });
+  const helpers = createSessionHelpers({ namespace });
+
+  // Prior stored hashes for topic-* slugs at the current ACTIVE version, for
+  // delta skip. Same source as hashesHandler.
+  async function loadPriorTopicHashes() {
+    const activeVersion = await getActiveVersion();
+    if (activeVersion === null) return {};
+    const { ContentFiles } = cds.entities(namespace);
+    const rows = await SELECT.from(ContentFiles)
+      .where({ version: activeVersion })
+      .columns('slug', 'contentHash');
+    const out = {};
+    for (const r of rows) {
+      if (typeof r.slug === 'string' && r.slug.startsWith('topic-')) out[r.slug] = r.contentHash;
+    }
+    return out;
+  }
+
+  async function renderTopicsHandler(req, res) {
+    const sessionId = req.body?.sessionId;
+    if (!sessionId) return res.status(400).json({ error: 'sessionId is required' });
+    try {
+      const db = await cds.connect.to('db');
+      const shell = await shellLoader.get(); // { before, after, version } | null
+      const priorHashes = await loadPriorTopicHashes();
+      const counts = await renderTopicsIntoSession({ db, sessionId, helpers, priorHashes, shell });
+      return res.status(200).json(counts);
+    } catch (err) {
+      console.error('[render-topics] phase failed:', err?.message);
+      metrics.counter('topic_render_batch_failure');
+      // Leave the session for the caller to abort — do not commit here.
+      return res.status(500).json({ error: err?.message || 'render-topics failed' });
+    }
+  }
+
+  return { renderTopicsHandler };
+}
+
+const _default = createRenderTopics();
+export const renderTopicsHandler = _default.renderTopicsHandler;
diff --git a/srv/lib/seed-category-descriptions.js b/srv/lib/seed-category-descriptions.js
new file mode 100644
index 000000000..32c5586e1
--- /dev/null
+++ b/srv/lib/seed-category-descriptions.js
@@ -0,0 +1,64 @@
+// srv/lib/seed-category-descriptions.js
+//
+// Idempotent, NON-DESTRUCTIVE boot-seed for Category.seedDescription.
+//
+// Categories.csv ships ID/slug/label/sortOrder only — the admin-editable
+// seedDescription column is deliberately absent (a CSV column would
+// full-replace admin edits on every deploy; see CLAUDE.md "CSV changes wipe
+// admin-editable columns"). So the baseline seed texts live in
+// ./category-seed-descriptions-defaults.js and are applied here, filling ONLY
+// rows whose seedDescription is currently empty/null. Rows an author has
+// already edited (non-empty) are never touched.
+//
+// Called from:
+//   - srv/server.js  cds.on('served')  (guarded by globalThis sentinel + VITEST gate)
+//   - test/unit + test/hybrid           (via dynamic import, passing a db override)
+
+import cds from '@sap/cds';
+import { CATEGORY_SEED_DESCRIPTIONS } from './category-seed-descriptions-defaults.js';
+
+const NAMESPACE = 'com.sap.developers.ims';
+
+/**
+ * Seed missing Category.seedDescription values idempotently.
+ *
+ * @param {object} [dbOverride] — already-connected cds db (tests). When omitted,
+ *   connects via cds.connect.to('db').
+ * @returns {Promise<{updated: number, total: number}>}
+ *   updated = rows whose empty seedDescription we filled this run
+ *   total   = category rows examined
+ */
+export async function seedCategoryDescriptions(dbOverride) {
+  const db = dbOverride ?? await cds.connect.to('db');
+
+  // Resolve Categories robustly across contexts (booted server / cds.test →
+  // cds.entities() installed; standalone `cds bind --exec` → model not linked
+  // into globals, so load+link). Same gotcha as seed-poc-puzzle.js.
+  let Categories;
+  if (typeof cds.entities === 'function' && cds.model) {
+    ({ Categories } = cds.entities(NAMESPACE));
+  } else {
+    const linked = cds.linked(await cds.load('*'));
+    ({ Categories } = linked.entities(NAMESPACE));
+  }
+
+  // Explicit columns: a bare SELECT emits `SELECT *`, which HANA cannot infer
+  // when the entity comes from a separately-linked model (standalone path).
+  const rows = await db.run(
+    SELECT.from(Categories).columns('ID', 'slug', 'seedDescription')
+  );
+
+  let updated = 0;
+  for (const row of rows) {
+    const seed = CATEGORY_SEED_DESCRIPTIONS[row.slug];
+    if (!seed) continue;                                   // slug not in defaults → leave alone
+    const current = (row.seedDescription ?? '').trim();
+    if (current) continue;                                 // author-authored / already seeded → preserve
+    await db.run(
+      UPDATE(Categories).set({ seedDescription: seed }).where({ ID: row.ID })
+    );
+    updated++;
+  }
+
+  return { updated, total: rows.length };
+}
diff --git a/srv/lib/topic-detail-render.js b/srv/lib/topic-detail-render.js
new file mode 100644
index 000000000..59216a3ef
--- /dev/null
+++ b/srv/lib/topic-detail-render.js
@@ -0,0 +1,56 @@
+import { createHash } from 'node:crypto';
+
+function esc(s) {
+  return String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+
+export function renderTopicDetail(topic) {
+  if (!topic?.slug || !topic?.label) throw new Error('renderTopicDetail: slug and label required');
+  const tutorials = (topic.tutorials || []).map(t => `
+      <li class="topic-tutorials__item">
+        <a class="topic-tutorials__link" href="${esc(t.href)}">${esc(t.title)}</a>
+        ${t.isNew ? '<span class="topic-tutorials__new">NEW</span>' : ''}
+        ${t.level ? `<span class="topic-tutorials__level">${esc(t.level)}</span>` : ''}
+      </li>`).join('');
+  const concepts = (topic.concepts || []).map(c => `
+      <li class="topic-concepts__item"><a href="/concepts/${esc(c.slug)}/">${esc(c.name)}</a></li>`).join('');
+  const related = (topic.relatedTags || []).map(r => `
+      <li class="topic-related__item"><a href="/topics/${esc(r.slug)}/">${esc(r.label)}</a></li>`).join('');
+
+  const conceptsSection = concepts
+    ? `<section class="topic-concepts" aria-labelledby="topic-concepts-h">
+        <h2 id="topic-concepts-h">Concepts in this topic</h2>
+        <ul class="topic-concepts__list" role="list">${concepts}</ul>
+      </section>`
+    : '';
+  const relatedSection = related
+    ? `<section class="topic-related" aria-labelledby="topic-related-h">
+        <h2 id="topic-related-h">Related topics</h2>
+        <ul class="topic-related__list" role="list">${related}</ul>
+      </section>`
+    : '';
+
+  const body = `<main>
+  <article class="topic-detail">
+    <nav class="topic-breadcrumb" aria-label="Breadcrumb">
+      <ol class="topic-breadcrumb__list">
+        <li><a href="/">Home</a></li>
+        <li><a href="/topics/">Topics</a></li>
+        <li aria-current="page">${esc(topic.label)}</li>
+      </ol>
+    </nav>
+    <header class="topic-detail__header">
+      <h1 class="topic-detail__title">${esc(topic.label)}</h1>
+      <p class="topic-detail__facet">${esc(topic.facet)}</p>
+    </header>
+    <section class="topic-tutorials" aria-labelledby="topic-tutorials-h">
+      <h2 id="topic-tutorials-h">Tutorials</h2>
+      <ul class="topic-tutorials__list" role="list">${tutorials || '<li>No tutorials yet.</li>'}</ul>
+    </section>
+    ${conceptsSection}
+    ${relatedSection}
+  </article>
+</main>`;
+  const contentHash = createHash('sha256').update(body, 'utf-8').digest('hex');
+  return { body, contentHash };
+}
diff --git a/srv/lib/topic-list-page.js b/srv/lib/topic-list-page.js
new file mode 100644
index 000000000..7b40ae55e
--- /dev/null
+++ b/srv/lib/topic-list-page.js
@@ -0,0 +1,201 @@
+// srv/lib/topic-list-page.js
+//
+// CAP-rendered Topics index page: GET /content/topics-index → /topics/.
+// Mirrors the pattern of concept-list-page.js (Task 2 of concepts-scale plan).
+// Renders an SSR shell with a nested <details>/<ul> tree (SEO / no-JS) plus
+// the full tree embedded as JSON for the topics-tree Vue island to enhance.
+
+import cds from '@sap/cds';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
+
+const _dir = dirname(fileURLToPath(import.meta.url));
+// Lazy-loaded island manifest: maps entry name → content-hashed public path.
+// Written by scripts/build-island-manifest.cjs alongside hugo/data/island_manifest.json.
+// Fail-open: returns the bare /js/<name>.js if the file is absent.
+let _islandManifest;
+function islandSrc(name) {
+  if (!_islandManifest) {
+    try {
+      _islandManifest = JSON.parse(readFileSync(join(_dir, 'island-manifest.json'), 'utf8'));
+    } catch {
+      _islandManifest = {};
+    }
+  }
+  return _islandManifest[name] ?? `/js/${name}.js`;
+}
+
+import { createShellLoader, ShellMarkerError, composeShell } from './chrome-shell.js';
+import { buildTopicsTreePayload } from './topics-query.js';
+import { setContentCacheHeaders } from './edge-cache-headers.js';
+import * as metrics from './metrics.js';
+
+const DEFAULT_NAMESPACE = 'com.sap.developers.ims';
+
+function escapeHtml(value) {
+  if (value === null || value === undefined) return '';
+  return String(value)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+// Ensure embedded JSON cannot escape a <script> context.
+function jsonForScript(obj) {
+  return JSON.stringify(obj).replace(/</g, '\\u003c');
+}
+
+const TOPICS_STYLE = `<style>
+.topics-index{max-width:64rem;margin:0 auto;padding:1rem}
+.topics-index details{margin:.25rem 0}
+.topics-index summary{cursor:pointer;font-weight:600}
+.topics-index ul{list-style:none;padding-left:1.25rem;margin:.25rem 0}
+.topics-index__count{color:#556;font-size:.85em;margin-left:.4em}
+.topics-index__filter{width:100%;max-width:28rem;padding:.5rem;margin:.5rem 0}
+</style>`;
+
+function renderNode(node) {
+  const count = node.slug
+    ? `<span class="topics-index__count">${node.tutorialCount ?? 0} tutorials · ${node.conceptCount ?? 0} concepts</span>`
+    : '';
+  const label = node.slug
+    ? `<a href="/topics/${escapeHtml(node.slug)}/">${escapeHtml(node.label)}</a>${count}`
+    : escapeHtml(node.label);
+  if (node.children && node.children.length) {
+    return `<li><details><summary>${label}</summary><ul>${node.children.map(renderNode).join('')}</ul></details></li>`;
+  }
+  return `<li>${label}</li>`;
+}
+
+export function renderTopicListBody(model) {
+  const facets = (model.tree || []).map(f =>
+    `<li><details open><summary>${escapeHtml(f.label)}</summary><ul>${(f.children || []).map(renderNode).join('')}</ul></details></li>`,
+  ).join('');
+  const data = jsonForScript({ tree: model.tree || [] });
+  return `${TOPICS_STYLE}
+<article class="topics-index" id="topics-tree-root">
+  <h1>Explore topics</h1>
+  <input type="search" class="topics-index__filter" id="topics-filter-input"
+    placeholder="Filter topics…" aria-label="Filter topics">
+  <ul>${facets}</ul>
+  <p><a href="/tutorial-navigator/">Search all tutorials →</a></p>
+</article>
+<script type="application/json" id="topics-tree-data">${data}</script>
+<script type="module" src="${islandSrc('topics-tree')}" defer></script>`;
+}
+
+/**
+ * Pure-ish data assembly for the topics list page.
+ * @param {object} db   CDS db service
+ * @returns {Promise<{tree, version}>}  version is null here; the handler stamps it.
+ */
+export async function buildTopicListModel(db, _deps = {}) {
+  const payload = await buildTopicsTreePayload(db);
+  return { tree: payload.tree || [], version: null };
+}
+
+/**
+ * Factory — builds an Express handler bound to a namespace, owning its own
+ * getActiveVersion + shellLoader + version-keyed gzip cache.
+ */
+export function createTopicListPage({ namespace = DEFAULT_NAMESPACE, deps = {} } = {}) {
+  const hanaTableName = () => `${namespace.replace(/\./g, '_').toUpperCase()}_CONTENTFILES`;
+
+  async function getActiveVersion() {
+    const { ContentManifest } = cds.entities(namespace);
+    const [row] = await SELECT.from(ContentManifest)
+      .where({ status: 'ACTIVE' })
+      .columns('version');
+    return row?.version ?? null;
+  }
+
+  const shellLoader = createShellLoader({ namespace, hanaTableName, getActiveVersion });
+
+  // Module-level version-keyed cache: { version, gzip, etag }.
+  let cache = null;
+
+  function fallbackShellCompose(body, meta) {
+    const s = escapeHtml;
+    return `<!DOCTYPE html><html lang="en" data-page-kind="${s(meta.kind)}" ` +
+      `data-page-slug="${s(meta.slug)}" data-page-title="${s(meta.title)}">` +
+      `<head><meta charset="utf-8"><title>${s(meta.title)}</title>` +
+      `<link rel="stylesheet" href="/css/sap-theme-vars.css">` +
+      `<link rel="stylesheet" href="/css/sap-fundamental.css">` +
+      `</head><body><main>${body}</main></body></html>`;
+  }
+
+  async function topicsIndexHandler(req, res) {
+    const started = Date.now();
+    try {
+      const db = await cds.connect.to('db');
+      const version = await getActiveVersion();
+
+      // Cache hit — same active manifest version.
+      if (cache && cache.version === version) {
+        metrics.counter('topic_list_cache_hits');
+        const ifNoneMatch = req.headers['if-none-match'];
+        if (ifNoneMatch && ifNoneMatch === cache.etag) return res.status(304).end();
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.setHeader('Content-Encoding', 'gzip');
+        setContentCacheHeaders(res, { slug: 'topics' });
+        res.setHeader('ETag', cache.etag);
+        res.setHeader('X-Content-Source', 'memcache');
+        return res.status(200).send(cache.gzip);
+      }
+      metrics.counter('topic_list_cache_misses');
+
+      const model = await buildTopicListModel(db, deps);
+      model.version = version;
+      const body = renderTopicListBody(model);
+      const meta = { kind: 'topics-index', slug: 'topics', title: 'Topics', description: 'Browse SAP developer topics by product and technology hierarchy.' };
+
+      let html;
+      try {
+        const shell = await shellLoader.get();
+        if (!shell) throw new ShellMarkerError('shell unavailable');
+        html = composeShell(shell, body, meta);
+      } catch (err) {
+        console.warn('[content/topics-index] chrome shell missing — degraded rendering:', err.message);
+        html = fallbackShellCompose(body, meta);
+      }
+
+      const gzip = gzipSync(Buffer.from(html, 'utf-8'));
+      const etag = `"${version ?? 'none'}"`;
+      cache = { version, gzip, etag };
+
+      metrics.observe('topic_list_render_ms', Date.now() - started);
+      const ifNoneMatch = req.headers['if-none-match'];
+      if (ifNoneMatch && ifNoneMatch === etag) return res.status(304).end();
+      res.setHeader('Content-Type', 'text/html; charset=utf-8');
+      res.setHeader('Content-Encoding', 'gzip');
+      setContentCacheHeaders(res, { slug: 'topics' });
+      res.setHeader('ETag', etag);
+      res.setHeader('X-Content-Source', 'fresh');
+      return res.status(200).send(gzip);
+    } catch (err) {
+      metrics.counter('topic_list_query_failure');
+      console.error('[content/topics-index] build failed:', err?.message);
+      // Serve last-known-good if we have any, even across versions.
+      if (cache) {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.setHeader('Content-Encoding', 'gzip');
+        res.setHeader('Cache-Control', 'public, max-age=60');
+        res.setHeader('ETag', cache.etag);
+        res.setHeader('X-Content-Source', 'stale');
+        return res.status(200).send(cache.gzip);
+      }
+      res.setHeader('Content-Type', 'text/html; charset=utf-8');
+      return res.status(503).send('<!DOCTYPE html><html><body><main><h1>Topics temporarily unavailable</h1><p>Please try again shortly.</p></main></body></html>');
+    }
+  }
+
+  return { topicsIndexHandler, _invalidate() { cache = null; shellLoader.invalidate?.(); } };
+}
+
+const _default = createTopicListPage();
+export const topicsIndexHandler = _default.topicsIndexHandler;
+export default topicsIndexHandler;
diff --git a/srv/lib/topic-slug.js b/srv/lib/topic-slug.js
new file mode 100644
index 000000000..1da7c7a5e
--- /dev/null
+++ b/srv/lib/topic-slug.js
@@ -0,0 +1,66 @@
+// URL-safe topic slug: lowercase, every run of non-[a-z0-9] → single hyphen,
+// trimmed. Real Tags.titlePath values carry spaces, colons and slashes
+// (e.g. "software product : technology platform / ... / open connectors");
+// the serve path (serveHandler VALID_SLUG=/^[a-z0-9][a-z0-9-]*$/) rejects any
+// slug that is not [a-z0-9-], so every character class outside that MUST be
+// folded to a hyphen here or the /topics/<slug> route 404s (#2099 defect).
+export function slugifyTopic(value) {
+  return String(value)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+// Back-compat name: same URL-safe folding. Previously only collapsed `--`→`-`,
+// which left spaces/colons/slashes intact and produced un-servable slugs.
+export function flattenTopicSlug(value) {
+  return slugifyTopic(value);
+}
+
+// Real Tags.titlePath uses " : " to separate the FACET from the value and
+// " / " to separate hierarchy LEVELS, e.g.
+//   "Software Product : Enterprise Management / SAP S 4HANA"
+// Product-name slashes are pre-spaced in the source ("SAP S/4HANA" → "SAP S
+// 4HANA"), so the spaced " : " / " / " separators are unambiguous. The legacy
+// ">" facet / "--" level separators never appear in live data — parsing on
+// them collapsed every titlePath into one facetless segment, which is what
+// flattened the /topics/ tree.
+export function parseTitlePath(titlePath) {
+  const str = String(titlePath);
+  const idx = str.indexOf(' : ');
+  const facet = idx === -1 ? '' : str.slice(0, idx).trim();
+  const value = (idx === -1 ? str : str.slice(idx + 3)).trim();
+  const segments = value.split(' / ').map(s => s.trim()).filter(Boolean);
+  return { facet, value, segments: segments.length ? segments : [value] };
+}
+
+// Deterministic slug map. The slug is derived from the FULL titlePath (not the
+// post-facet value) so that already-published `topic-<slug>` BLOB keys and
+// their `/topics/<slug>/` URLs stay byte-stable even though facet/segments now
+// parse into a hierarchy for the tree. Rare full-path slug collisions (two
+// titlePaths that slugify identically) get an index suffix.
+export function buildTopicSlugMap(liveTags) {
+  const bySlug = new Map();
+  const byTag = new Map();
+  const sorted = [...liveTags].sort((a, b) => a.titlePath.localeCompare(b.titlePath));
+  for (const raw of sorted) {
+    const { facet, value, segments } = parseTitlePath(raw.titlePath);
+    const base = flattenTopicSlug(raw.titlePath);
+    let slug = base;
+    let n = 2;
+    while (bySlug.has(slug)) slug = `${base}-${n++}`;
+    const tag = {
+      titlePath: raw.titlePath, facet, value, segments, slug,
+      label: raw.label || segments[segments.length - 1],
+      tutorialCount: raw.tutorialCount ?? 0,
+      conceptCount: raw.conceptCount ?? 0,
+    };
+    bySlug.set(slug, tag);
+    byTag.set(raw.titlePath, slug);
+  }
+  return { bySlug, byTag };
+}
+
+export function normalizeLegacyTopicSlug(slug) {
+  return String(slug).replace(/-\d+$/, '');
+}
diff --git a/srv/lib/topics-query.js b/srv/lib/topics-query.js
new file mode 100644
index 000000000..a2ed75b04
--- /dev/null
+++ b/srv/lib/topics-query.js
@@ -0,0 +1,184 @@
+// srv/lib/topics-query.js
+import cds from '@sap/cds';
+import { buildTopicSlugMap, normalizeLegacyTopicSlug } from './topic-slug.js';
+
+const NS = 'com.sap.developers.ims';
+const MAX_TUTORIALS = 60;
+const MAX_CONCEPTS = 24;
+
+function ent() {
+  const { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank } = cds.entities(NS);
+  return { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank };
+}
+
+function humanizeFacet(facet) {
+  return String(facet).split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+}
+
+// Live-tag set (applied to ≥1 tutorial) with per-tag tutorial + concept counts.
+export async function loadLiveTags(db) {
+  const { Tags, TutorialTags, TutorialConceptLinks } = ent();
+  const tags = await db.run(SELECT.from(Tags).columns('ID', 'titlePath', 'label', 'name'));
+  const tagById = new Map(tags.map(t => [t.ID, t]));
+  const links = await db.run(SELECT.from(TutorialTags).columns('tutorial_ID', 'tag_ID'));
+
+  const tutorialIdsByTag = new Map(); // tag_ID -> Set(tutorial_ID)
+  for (const l of links) {
+    if (!tagById.has(l.tag_ID)) continue;
+    (tutorialIdsByTag.get(l.tag_ID) ?? tutorialIdsByTag.set(l.tag_ID, new Set()).get(l.tag_ID)).add(l.tutorial_ID);
+  }
+
+  // Bulk teaches-links → tutorial_ID -> Set(concept_ID); unbounded fetch, filter in Node.
+  const teaches = await db.run(
+    SELECT.from(TutorialConceptLinks).columns('tutorial_ID', 'concept_ID').where({ predicate: 'teaches' }),
+  );
+  const conceptsByTutorial = new Map();
+  for (const t of teaches) {
+    if (!t.concept_ID) continue;
+    (conceptsByTutorial.get(t.tutorial_ID) ?? conceptsByTutorial.set(t.tutorial_ID, new Set()).get(t.tutorial_ID)).add(t.concept_ID);
+  }
+
+  const liveRaw = [];
+  for (const [tagId, tutSet] of tutorialIdsByTag) {
+    const tag = tagById.get(tagId);
+    if (!tag?.titlePath) continue;
+    const conceptSet = new Set();
+    for (const tutId of tutSet) for (const c of (conceptsByTutorial.get(tutId) ?? [])) conceptSet.add(c);
+    liveRaw.push({ titlePath: tag.titlePath, label: tag.label, tutorialCount: tutSet.size, conceptCount: conceptSet.size });
+  }
+  const { bySlug } = buildTopicSlugMap(liveRaw);
+  return [...bySlug.values()];
+}
+
+export async function buildTopicsTreePayload(db) {
+  try {
+    const live = await loadLiveTags(db);
+    const facets = new Map(); // facet -> node
+    for (const tag of live) {
+      if (!facets.has(tag.facet)) facets.set(tag.facet, { facet: tag.facet, label: humanizeFacet(tag.facet), children: [] });
+      const facetNode = facets.get(tag.facet);
+      let level = facetNode.children;
+      for (let i = 0; i < tag.segments.length; i++) {
+        const seg = tag.segments[i];
+        let node = level.find(n => n.segment === seg);
+        if (!node) { node = { segment: seg, label: seg, children: [] }; level.push(node); }
+        if (i === tag.segments.length - 1) {
+          node.slug = tag.slug;
+          node.label = tag.label || seg;
+          node.tutorialCount = tag.tutorialCount;
+          node.conceptCount = tag.conceptCount;
+        }
+        level = node.children;
+      }
+    }
+    const sortRec = (nodes) => {
+      nodes.sort((a, b) => a.label.localeCompare(b.label));
+      for (const n of nodes) sortRec(n.children);
+    };
+    const tree = [...facets.values()].sort((a, b) => a.label.localeCompare(b.label));
+    for (const f of tree) sortRec(f.children);
+    return { tree, buildAt: new Date().toISOString(), error: null };
+  } catch (err) {
+    return { tree: [], buildAt: new Date().toISOString(), error: err.message };
+  }
+}
+
+export async function resolveTopicBySlug(db, slug, live) {
+  if (!live) live = await loadLiveTags(db);
+  const bySlug = new Map(live.map(t => [t.slug, t]));
+  if (bySlug.has(slug)) return { tag: bySlug.get(slug), redirectTo: null };
+  const base = normalizeLegacyTopicSlug(slug);
+  if (base !== slug && bySlug.has(base)) return { tag: bySlug.get(base), redirectTo: `/topics/${base}/` };
+  return { tag: null, redirectTo: '/topics/' };
+}
+
+/**
+ * Load the full per-publish corpus once so the publish loop can pass it to
+ * every buildTopicDetailPayload call instead of re-running O(topics) identical
+ * full-table reads.
+ *
+ * @param {object} db  CDS db service
+ * @returns {Promise<{live: Array, allTuts: Array, teaches: Array, allConcepts: Array, rankBySlug: Map}>}
+ */
+export async function loadTopicCorpus(db) {
+  const { Tutorials, TutorialConceptLinks, Concepts, ConceptRank } = ent();
+  const live = await loadLiveTags(db);
+  const allTuts = await db.run(SELECT.from(Tutorials).columns('ID', 'slug', 'title', 'experienceTag', 'averageTimeToComplete'));
+  const teaches = await db.run(SELECT.from(TutorialConceptLinks).columns('tutorial_ID', 'concept_ID').where({ predicate: 'teaches' }));
+  const allConcepts = await db.run(SELECT.from(Concepts).columns('ID', 'slug', 'name').where({ status: 'ACTIVE' }));
+  const rankRows = await db.run(SELECT.from(ConceptRank).columns('slug', 'score')).catch(() => []);
+  const rankBySlug = new Map(rankRows.map(r => [r.slug, r.score]));
+  return { live, allTuts, teaches, allConcepts, rankBySlug };
+}
+
+export async function buildTopicDetailPayload(db, slug, corpus) {
+  try {
+    // When corpus is provided (publish loop), reuse the pre-loaded live list;
+    // otherwise load fresh (single-slug serve path — corpus arg is absent).
+    const live = corpus ? corpus.live : await loadLiveTags(db);
+    const { tag, redirectTo } = await resolveTopicBySlug(db, slug, live);
+    if (!tag) return { slug, notFound: true, redirectTo, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: null };
+    if (redirectTo) return { slug: tag.slug, notFound: false, redirectTo, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: null };
+
+    const { Tags, TutorialTags, Tutorials, TutorialConceptLinks, Concepts, ConceptRank } = ent();
+
+    // tutorials carrying this tag (per-slug — NOT hoistable into corpus)
+    const tagRow = await db.run(SELECT.one.from(Tags).columns('ID').where({ titlePath: tag.titlePath }));
+    const ttRows = tagRow ? await db.run(SELECT.from(TutorialTags).columns('tutorial_ID', 'tag_ID').where({ tag_ID: tagRow.ID })) : [];
+    const tutIds = new Set(ttRows.map(r => r.tutorial_ID));
+
+    // corpus reads — reuse pre-loaded data when caller provides corpus (publish
+    // loop), otherwise load fresh (single-slug serve path).
+    // Column verification: Tutorials has averageTimeToComplete (Integer) from TaskBase,
+    // not timeToComplete/time/estimatedTime. isNew does not exist — omitted from projection.
+    const allTuts = corpus
+      ? corpus.allTuts
+      : await db.run(SELECT.from(Tutorials).columns('ID', 'slug', 'title', 'experienceTag', 'averageTimeToComplete'));
+    const tutorials = allTuts
+      .filter(t => tutIds.has(t.ID))
+      .map(t => ({
+        slug: String(t.slug || '').toLowerCase(),
+        title: t.title,
+        level: t.experienceTag || null,
+        time: t.averageTimeToComplete || null,
+        href: `/tutorials/${String(t.slug || '').toLowerCase()}/`,
+        isNew: false, // isNew column absent from Tutorials model; always false until schema adds it
+      }))
+      .sort((a, b) => a.title.localeCompare(b.title))
+      .slice(0, MAX_TUTORIALS);
+
+    // concepts taught by those tutorials (unbounded fetch + Node filter)
+    const teaches = corpus
+      ? corpus.teaches
+      : await db.run(SELECT.from(TutorialConceptLinks).columns('tutorial_ID', 'concept_ID').where({ predicate: 'teaches' }));
+    const conceptIds = new Set(teaches.filter(l => tutIds.has(l.tutorial_ID) && l.concept_ID).map(l => l.concept_ID));
+    const allConcepts = corpus
+      ? corpus.allConcepts
+      : await db.run(SELECT.from(Concepts).columns('ID', 'slug', 'name').where({ status: 'ACTIVE' }));
+    const rankBySlug = corpus
+      ? corpus.rankBySlug
+      : new Map((await db.run(SELECT.from(ConceptRank).columns('slug', 'score')).catch(() => [])).map(r => [r.slug, r.score]));
+    const concepts = allConcepts
+      .filter(c => conceptIds.has(c.ID))
+      .map(c => ({ slug: c.slug, name: c.name, rank: rankBySlug.get(c.slug) ?? 0 }))
+      .sort((a, b) => b.rank - a.rank || a.name.localeCompare(b.name))
+      .slice(0, MAX_CONCEPTS);
+
+    // related tags = same-facet siblings sharing the parent segment (reuses live loaded above)
+    const parent = tag.segments.slice(0, -1);
+    const relatedTags = live
+      .filter(t => t.slug !== tag.slug && t.facet === tag.facet)
+      .filter(t => parent.length === 0 || parent.every((seg, i) => t.segments[i] === seg))
+      .map(t => ({ slug: t.slug, label: t.label }))
+      .sort((a, b) => a.label.localeCompare(b.label))
+      .slice(0, 24);
+
+    return {
+      slug: tag.slug, label: tag.label, facet: tag.facet,
+      tutorials, concepts, relatedTags,
+      buildAt: new Date().toISOString(), error: null,
+    };
+  } catch (err) {
+    return { slug, tutorials: [], concepts: [], relatedTags: [], buildAt: new Date().toISOString(), error: err.message };
+  }
+}
diff --git a/srv/lib/validation-rules-publish.js b/srv/lib/validation-rules-publish.js
new file mode 100644
index 000000000..ba7f934d1
--- /dev/null
+++ b/srv/lib/validation-rules-publish.js
@@ -0,0 +1,75 @@
+// srv/lib/validation-rules-publish.js
+// Handler for POST /content/publish-validation-rules.
+//
+// Bearer auth is delegated to `contentAuthMiddleware` from
+// srv/lib/content-store.js — same shape as /content/publish-contributors:
+// 503 when CONTENT_API_KEY is unset, 401 on missing Bearer header, 403 on
+// wrong key, with timing-safe comparison.
+//
+// Accepts `{ slug, rules: AllRuleRow[] }` and REPLACE-per-slug:
+// DELETEs all TutorialValidationRules rows for that tutorial then INSERTs
+// the new set atomically inside cds.tx(). Publishing slug A never touches
+// slug B's rows.
+
+import cds from '@sap/cds'
+
+const NS = 'com.sap.developers.ims'
+
+/**
+ * Core, unit-testable: REPLACE all validation-rule rows for one slug.
+ * @param {object} db   – connected CDS db service (cds.connect.to('db'))
+ * @param {string} slug – tutorial slug (case-insensitive)
+ * @param {Array}  rules – array of rule objects from the sidecar JSON
+ */
+export async function replaceValidationRulesForSlug(db, slug, rules) {
+  const { Tutorials, TutorialValidationRules } = cds.entities(NS)
+  const lcSlug = String(slug || '').toLowerCase()
+  const tut = await db.run(SELECT.one.from(Tutorials).columns('ID').where({ slug: lcSlug }))
+  if (!tut) return { ok: false, reason: 'tutorial_not_found', slug: lcSlug }
+
+  const entries = (rules || []).map((r) => ({
+    tutorial_ID: tut.ID,
+    stepNumber: r.stepNumber,
+    questionId: String(r.questionId).slice(0, 100),
+    questionText: (r.questionText || '').slice(0, 2000),
+    ruleType: (r.ruleType || '').slice(0, 50),
+    questionType: (r.questionType || '').slice(0, 20),
+    choiceMode: r.choiceMode || null,
+    options: r.options || null,
+    correctAnswer: r.correctAnswer ?? null,
+    aiGrading: Boolean(r.aiGrading),
+  }))
+
+  await cds.tx(async (tx) => {
+    await tx.run(DELETE.from(TutorialValidationRules).where({ tutorial_ID: tut.ID }))
+    if (entries.length) await tx.run(INSERT.into(TutorialValidationRules).entries(entries))
+  })
+  return { ok: true, slug: lcSlug, count: entries.length }
+}
+
+/**
+ * Express handler mirroring the publish-contributors route shape.
+ * Mounted in server.js with contentAuthMiddleware + express.json().
+ */
+export async function publishValidationRules(req, res) {
+  try {
+    const { slug, rules } = req.body || {}
+    if (!slug || !Array.isArray(rules)) {
+      return res.status(400).json({ error: 'bad_request', detail: 'expected { slug, rules[] }' })
+    }
+
+    // entity_not_in_model guard (QA namespace safety — mirrors contributors-publish.js).
+    let entities
+    try { entities = cds.entities(NS) } catch { entities = null }
+    if (!entities || !entities.TutorialValidationRules) {
+      return res.status(409).json({ error: 'entity_not_in_model' })
+    }
+
+    const db = await cds.connect.to('db')
+    const result = await replaceValidationRulesForSlug(db, slug, rules)
+    if (!result.ok) return res.status(404).json(result)
+    return res.json(result)
+  } catch (e) {
+    return res.status(500).json({ error: 'internal', detail: e?.message })
+  }
+}
diff --git a/srv/routes/devtoberfest-schedule-check.js b/srv/routes/devtoberfest-schedule-check.js
new file mode 100644
index 000000000..aa653a718
--- /dev/null
+++ b/srv/routes/devtoberfest-schedule-check.js
@@ -0,0 +1,92 @@
+// srv/routes/devtoberfest-schedule-check.js
+//
+// Admin-only schedule-consistency check (issue #2103):
+//   GET /api/devtoberfest/schedule-check?edition=<id>
+//
+// Reconciles each planner session's SCHEDULEDSTART against the *actual*
+// scheduled start times on its external assets — the YouTube livestream and the
+// community.sap.com event — and reports any that have drifted apart. See
+// srv/lib/devtoberfest-schedule-check.js for the comparison logic and why Zoom
+// is not checked.
+//
+// Admin-gated (user.is('Admin')); this surfaces operator-facing data (URLs,
+// drift) and calls out to external APIs, so it is not public. Fails soft: an
+// external time we cannot read is reported 'unknown', never a spurious mismatch.
+import cds from '@sap/cds';
+import { resolveUser } from '../lib/resolve-user.js';
+import { resolveSecret } from '../lib/secret-resolver.js';
+import { buildScheduleCheckReport } from '../lib/devtoberfest-schedule-check.js';
+
+const LOG = cds.log('devtoberfest');
+
+async function resolveEditionId(ext, requested) {
+  if (requested) return requested;
+  try {
+    const cur = await SELECT.one.from(ext.Edition).columns('ID').where({ ISCURRENT: true });
+    return cur?.ID || null;
+  } catch { return null; }
+}
+
+async function scheduleCheckHandler(req, res) {
+  try {
+    await cds.connect.to('db');
+
+    // Admin gate — mirror alerts-public.js / server.js admin express routes.
+    const user = resolveUser(req, cds) || cds.context?.user;
+    if (!user?.id || user.id === 'anonymous') {
+      return res.status(401).json({ error: 'UNAUTHENTICATED' });
+    }
+    if (!(typeof user.is === 'function' && user.is('Admin') === true)) {
+      return res.status(403).json({ error: 'FORBIDDEN' });
+    }
+
+    let ext;
+    try { ext = cds.entities('external.devtoberfest'); } catch { ext = null; }
+    if (!ext?.Session) return res.status(503).json({ error: 'EVENT_NOT_CONFIGURED' });
+
+    const editionId = await resolveEditionId(ext, req.query.edition);
+    if (!editionId) return res.status(503).json({ error: 'EVENT_NOT_CONFIGURED' });
+
+    // Sessions belong to tracks, tracks to editions. Same join the schedule
+    // feed uses (devtoberfest-schedule.js), but we only need the URL columns.
+    let sessions = [];
+    try {
+      const tracks = await SELECT.from(ext.Track).columns('ID').where({ EDITION_ID: editionId });
+      const trackIds = tracks.map((t) => t.ID);
+      sessions = trackIds.length
+        ? await SELECT.from(ext.Session)
+            .columns('ID', 'SESSIONCODE', 'TITLE', 'SCHEDULEDSTART', 'SCHEDULEDTIMEZONE', 'YOUTUBEURL', 'COMMUNITYEVENTURL')
+            .where({ TRACK_ID: { in: trackIds } })
+        : [];
+    } catch (err) {
+      LOG.warn('schedule-check facade read failed:', err.message);
+      return res.status(503).json({ error: 'EVENT_NOT_CONFIGURED' });
+    }
+
+    // YOUTUBE_API_KEY is optional: without it the YouTube leg reports 'unknown'
+    // for every session (fail-soft) rather than erroring the whole report.
+    let apiKey = null;
+    try { apiKey = await resolveSecret('YOUTUBE_API_KEY', { logTag: '[schedule-check]' }); }
+    catch (e) { LOG.warn('YOUTUBE_API_KEY unavailable, YouTube leg will be unknown:', e?.message); }
+
+    const tolQ = Number.parseInt(req.query.tolerance, 10);
+    const toleranceMinutes = Number.isFinite(tolQ) && tolQ >= 0 ? tolQ : undefined;
+
+    const report = await buildScheduleCheckReport(sessions, { apiKey, toleranceMinutes });
+
+    // Operator report against live external state — never cache at the edge.
+    res.setHeader('Cache-Control', 'no-store');
+    return res.status(200).json({ editionId, ...report });
+  } catch (err) {
+    LOG.error('GET /api/devtoberfest/schedule-check failed:', err);
+    return res.status(500).json({ error: 'INTERNAL' });
+  }
+}
+
+export function register(app) {
+  const _contextMw = cds.middlewares?.context?.() || ((req, _res, next) => next());
+  const _authMw = cds.middlewares?.auth?.() || ((req, _res, next) => next());
+  app.get('/api/devtoberfest/schedule-check', _contextMw, _authMw, scheduleCheckHandler);
+}
+
+export { scheduleCheckHandler };
diff --git a/srv/routes/devtoberfest-schedule.js b/srv/routes/devtoberfest-schedule.js
index 1691ff783..a495866f1 100644
--- a/srv/routes/devtoberfest-schedule.js
+++ b/srv/routes/devtoberfest-schedule.js
@@ -54,7 +54,7 @@ async function loadAssembledFeed(req) {
     const trackIds = tracks.map((t) => t.ID);
     sessions = trackIds.length
       ? await SELECT.from(ext.Session)
-          .columns('ID', 'SESSIONCODE', 'TRACK_ID', 'TITLE', 'ABSTRACT', 'STATUS', 'SESSIONLENGTH', 'WEEK', 'SCHEDULEDSTART', 'SCHEDULEDTIMEZONE', 'YOUTUBEURL', 'COMMUNITYEVENTURL', 'ACTIVITY_ID')
+          .columns('ID', 'SESSIONCODE', 'TRACK_ID', 'TITLE', 'ABSTRACT', 'STATUS', 'SESSIONLENGTH', 'WEEK', 'SCHEDULEDSTART', 'SCHEDULEDTIMEZONE', 'BROADCASTINGPREFERENCE', 'YOUTUBEURL', 'COMMUNITYEVENTURL', 'ACTIVITY_ID')
           .where({ TRACK_ID: { in: trackIds } })
       : [];
     activities = trackIds.length
diff --git a/srv/server.js b/srv/server.js
index 0367a3558..766bf9478 100644
--- a/srv/server.js
+++ b/srv/server.js
@@ -37,12 +37,17 @@ import { bumpCacheGeneration } from './lib/content-cache-coherence.js';
 import { conceptsIndexHandler } from './lib/concept-list-page.js';
 import { puzzlePageHandler, puzzleIndexHandler } from './lib/puzzle-page.js';
 import { renderConceptsHandler } from './lib/publish-concepts.js';
+import { renderTopicsHandler } from './lib/publish-topics.js';
+import { buildTopicsTreeHandler, buildTopicDetailHandler } from './lib/build-topics.js';
+import { topicsIndexHandler } from './lib/topic-list-page.js';
+import { resolveTopicBySlug } from './lib/topics-query.js';
 import { repoCatalogReadHandler, repoCatalogWriteHandler } from './lib/repo-catalog.js';
 import { modelJsonHandler } from './lib/model-json-handler.js';
 import { kgStatsHandler } from './routes/kg-stats.js';
 import * as advocatesPublic from './routes/advocates-public.js';
 import * as devtoberfestPublic from './routes/devtoberfest-public.js';
 import * as devtoberfestSchedule from './routes/devtoberfest-schedule.js';
+import * as devtoberfestScheduleCheck from './routes/devtoberfest-schedule-check.js';
 import * as devtoberfestAuth from './routes/devtoberfest-auth.js';
 import * as devtoberfestCatGame from './routes/devtoberfest-cat-game.js';
 import * as alertsPublic from './routes/alerts-public.js';
@@ -65,6 +70,8 @@ import { defaultCallModel } from './lib/code-check-llm.js';
 import { defaultLoadStepText } from './lib/code-check-step-loader.js';
 import { codeCheckSpecPublishHandler } from './lib/code-check-spec-publish.js';
 import { publishValidateAnswerSpecs } from './lib/validate-answer-spec-publish.js';
+import { publishContributors } from './lib/contributors-publish.js';
+import { publishValidationRules } from './lib/validation-rules-publish.js';
 import { resolveSearchSettings } from './lib/runtime-config/search-settings.js';
 import { resolveTenantSettings } from './lib/runtime-config/tenant-settings.js';
 import { makeValidateAnswerHandler } from './lib/validate-answer-handler.js';
@@ -296,6 +303,8 @@ cds.on('bootstrap', (app) => {
   app.get('/build/concepts', buildConceptsHandler);
   app.get('/build/topic-clusters', buildTopicClustersHandler);
   app.get('/build/topics-gallery', buildTopicsGalleryHandler);
+  app.get('/build/topics-tree', buildTopicsTreeHandler);
+  app.get('/build/topics/:slug', buildTopicDetailHandler);
   app.get('/graph/explore-data', exploreDataHandler);
   app.get('/graph/clusters-data', clustersDataHandler);
   app.get('/graph/path', graphPathHandler);
@@ -465,6 +474,7 @@ cds.on('bootstrap', (app) => {
   advocatesPublic.register(app);
   devtoberfestPublic.register(app);
   devtoberfestSchedule.register(app);
+  devtoberfestScheduleCheck.register(app);
   devtoberfestAuth.register(app);
   devtoberfestCatGame.register(app);
 
@@ -529,6 +539,55 @@ cds.on('bootstrap', (app) => {
   // here yet (the /concepts/?$ flip lands in Task 5). Public, no auth — like
   // serveHandler.
   app.get('/content/concepts-index', conceptsIndexHandler);
+  // #topics-scale Task 8 — CAP-served /topics/ detail pages (published topic-<slug>
+  // BLOBs) and the /topics/ index page. Mirrors the /content/concepts/:slug +
+  // /content/concepts-index pattern exactly: same serveHandler delegation, same
+  // two-arg call signature, no live-render fallback (concepts has none).
+  //
+  // Topics adds a legacy/retired slug resolution step: resolveTopicBySlug checks
+  // whether the slug is a renamed/retired tag and returns a redirectTo URL when it
+  // is. Both !tag+redirectTo and tag+redirectTo cases 301 — the redirect takes
+  // precedence whenever it is set, matching the brief spec.
+  app.get('/content/topics/:slug', async (req, res) => {
+    const raw = String(req.params.slug || '');
+    // Strip .html suffix → 301 to canonical /topics/<slug>
+    if (/\.html$/i.test(raw)) {
+      const stripped = raw.replace(/\.html$/i, '').toLowerCase();
+      if (/^[a-z0-9][a-z0-9-]*$/.test(stripped)) {
+        const qIdx = req.url.indexOf('?');
+        const query = qIdx >= 0 ? req.url.slice(qIdx) : '';
+        res.setHeader('Location', `/topics/${stripped}${query}`);
+        res.setHeader('Cache-Control', 'public, max-age=3600');
+        return res.status(301).end();
+      }
+    }
+    // Mixed-case → 301 to canonical lowercase /topics/<slug>
+    const lower = raw.toLowerCase();
+    if (raw && raw !== lower && /^[a-z0-9][a-z0-9-]*$/.test(lower)) {
+      const qIdx = req.url.indexOf('?');
+      const query = qIdx >= 0 ? req.url.slice(qIdx) : '';
+      res.setHeader('Location', `/topics/${lower}${query}`);
+      res.setHeader('Cache-Control', 'public, max-age=3600');
+      return res.status(301).end();
+    }
+    // Legacy / retired slug resolution → 301 to canonical replacement
+    try {
+      const db = await cds.connect.to('db');
+      const { redirectTo } = await resolveTopicBySlug(db, lower);
+      if (redirectTo) {
+        const qIdx = req.url.indexOf('?');
+        const query = qIdx >= 0 ? req.url.slice(qIdx) : '';
+        res.setHeader('Location', `${redirectTo}${query}`);
+        res.setHeader('Cache-Control', 'public, max-age=3600');
+        return res.status(301).end();
+      }
+    } catch { /* fail-open to blob lookup */ }
+    // Canonical form — delegate to serveHandler with the topic- prefix.
+    req.params.slug = `topic-${lower}`;
+    return serveHandler(req, res);
+  });
+  // Topics index page: /topics/ → CAP SSR (mirrors /content/concepts-index).
+  app.get('/content/topics-index', topicsIndexHandler);
   // #1914 — CAP-served puzzle solver pages (/puzzles/<slug>/, dynamic slug).
   // The page is a thin island shell composed into the __shell__ chrome; the
   // `puzzle` island fetches grid/clue data from /puzzle-api at runtime. Serving
@@ -571,6 +630,9 @@ cds.on('bootstrap', (app) => {
   // (Thread B). Dark launch: no publish-content.ts caller yet (Task 5 wires
   // it). Auth like the other publish routes.
   app.post('/content/publish/render-concepts', express.json({ limit: '1mb' }), contentAuthMiddleware, renderConceptsHandler);
+  // tag-tree-topics Task 7 — render topic detail pages alongside concepts.
+  // Auth and sequencing mirror render-concepts exactly.
+  app.post('/content/publish/render-topics', express.json({ limit: '1mb' }), contentAuthMiddleware, renderTopicsHandler);
   app.post('/content/publish/commit', express.json({ limit: '1mb' }),   contentAuthMiddleware, commitHandler);
   app.post('/content/publish/abort',  express.json({ limit: '1mb' }),   contentAuthMiddleware, abortHandler);
 
@@ -606,6 +668,22 @@ cds.on('bootstrap', (app) => {
     publishValidateAnswerSpecs
   );
 
+  // REPLACE-per-slug handler for TutorialContributors (WS2 #task-6).
+  // Same auth guard and body parser as the validate-answer-specs sibling.
+  app.post('/content/publish-contributors',
+    express.json({ limit: '1mb' }),
+    contentAuthMiddleware,
+    publishContributors
+  );
+
+  // REPLACE-per-slug handler for TutorialValidationRules (WS3 #task-13).
+  // Same auth guard and body parser shape as publish-contributors.
+  app.post('/content/publish-validation-rules',
+    express.json({ limit: '4mb' }),
+    contentAuthMiddleware,
+    publishValidationRules
+  );
+
   // Tutorial feedback bridge. Express handler (rather than letting CAP expose
   // the action over OData) so we can derive the originating client IP from
   // X-Forwarded-For and inject it into req.data via AsyncLocalStorage + a
@@ -1419,6 +1497,26 @@ cds.on('served', async () => {
     }
   }
 
+  // Seed baseline Category.seedDescription texts (tunes the embedding-based
+  // category classifier). Idempotent + non-destructive: fills only rows whose
+  // seedDescription is empty, never overwrites admin edits. Kept out of CSV so
+  // deploys can't full-replace the admin-editable column. VITEST-gated: seeding
+  // descriptions flips the classifier's embedding path ON, which would leak
+  // into unit tests asserting the LLM/skip fallback (see memory
+  // db-flag-boot-seed-leaks-into-vitest-harness). Non-fatal.
+  if (!process.env.VITEST && !globalThis.__categorySeedDescriptionsSeeded) {
+    globalThis.__categorySeedDescriptionsSeeded = true;
+    try {
+      const { seedCategoryDescriptions } = await import('./lib/seed-category-descriptions.js');
+      const result = await seedCategoryDescriptions(cds.db);
+      if (result.updated > 0) {
+        console.log(`[category-seed-descriptions] seeded ${result.updated}/${result.total} category descriptions`);
+      }
+    } catch (err) {
+      console.warn('[category-seed-descriptions] seed failed (non-fatal):', err.message);
+    }
+  }
+
   app.get('/auth/user', contextMw, authMw, async (req, res) => {
     // #1268: coarse deploy environment (DEV/PROD/QA/LOCAL) for the admin
     // header. Derived from the CF space name — safe to expose to anonymous
diff --git a/test/admin-published-guard.test.js b/test/admin-published-guard.test.js
new file mode 100644
index 000000000..f6d7a82ca
--- /dev/null
+++ b/test/admin-published-guard.test.js
@@ -0,0 +1,99 @@
+// test/admin-published-guard.test.js
+//
+// Regression for #2111: a non-SuperAdmin Admin/Author editing only the
+// description (or title) of an already-published Group/Mission was rejected
+// with 403 "Only SuperAdmin can change the published state". The draft
+// activation PATCH echoes the unchanged `published: true` flag, and the old
+// guard treated the mere *presence* of `published` in the payload as a change.
+//
+// The guard must reject only when the incoming `published` value actually
+// DIFFERS from the currently persisted value.
+import { describe, it, expect, afterAll, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+const project = cds.test('serve', '--project', '.', '--in-memory');
+
+const superAuth = { auth: { username: 'superadmin', password: 'superadmin' } };
+// `admin` has Admin (+ Tutorial.Author) but NOT SuperAdmin — the issue user.
+const adminAuth = { auth: { username: 'admin', password: 'admin' } };
+
+const TAG_ID = 'aaaaaaaa-3333-0000-0000-000000000911';
+
+describe('AdminService: published write-guard (#2111)', () => {
+  const cleanup = [];
+
+  beforeAll(async () => {
+    const { Tags } = cds.entities('com.sap.developers.ims');
+    await INSERT.into(Tags).entries({ ID: TAG_ID, legacyId: 92911, name: '__TEST__ Published Guard Tag' });
+  });
+
+  afterAll(async () => {
+    for (const url of cleanup) await project.delete(url, superAuth).catch(() => {});
+  });
+
+  // Create + activate a Group as SuperAdmin, optionally published.
+  const createGroup = async (title, { published = false } = {}) => {
+    const created = await project.post('/admin/Groups', {
+      title, description: 'initial', experienceTag: 'beginner', primaryTagRef_ID: TAG_ID, published,
+    }, { ...superAuth, headers: { Prefer: 'handling=lenient' } });
+    expect(created.status).toBe(201);
+    const ID = created.data.ID;
+    await project.post(
+      `/admin/Groups(ID=${ID},IsActiveEntity=false)/tags`, { tag_ID: TAG_ID }, superAuth);
+    const activated = await project.post(
+      `/admin/Groups(ID=${ID},IsActiveEntity=false)/AdminService.draftActivate`, {}, superAuth);
+    expect([200, 201]).toContain(activated.status);
+    cleanup.push(`/admin/Groups(ID=${ID},IsActiveEntity=true)`);
+    return activated.data;
+  };
+
+  const editDescriptionAs = async (auth, ID) => {
+    const edit = await project.post(
+      `/admin/Groups(ID=${ID},IsActiveEntity=true)/AdminService.draftEdit`, {}, auth);
+    expect([200, 201]).toContain(edit.status);
+    await project.patch(
+      `/admin/Groups(ID=${ID},IsActiveEntity=false)`, { description: 'edited by admin' }, auth);
+    return project.post(
+      `/admin/Groups(ID=${ID},IsActiveEntity=false)/AdminService.draftActivate`, {}, auth);
+  };
+
+  it('lets a non-SuperAdmin edit the description of a PUBLISHED group', async () => {
+    const g = await createGroup('__TEST__ Pub Guard Published', { published: true });
+    expect(g.published).toBe(true);
+
+    const res = await editDescriptionAs(adminAuth, g.ID);
+    expect([200, 201]).toContain(res.status);
+    expect(res.data.description).toBe('edited by admin');
+    expect(res.data.published).toBe(true); // unchanged
+  });
+
+  it('lets a non-SuperAdmin edit the description of an UNPUBLISHED group', async () => {
+    const g = await createGroup('__TEST__ Pub Guard Unpublished', { published: false });
+    const res = await editDescriptionAs(adminAuth, g.ID);
+    expect([200, 201]).toContain(res.status);
+    expect(res.data.description).toBe('edited by admin');
+  });
+
+  it('STILL rejects a non-SuperAdmin actually flipping published true→false', async () => {
+    const g = await createGroup('__TEST__ Pub Guard Flip', { published: true });
+    await project.post(
+      `/admin/Groups(ID=${g.ID},IsActiveEntity=true)/AdminService.draftEdit`, {}, adminAuth);
+    const res = await project.patch(
+      `/admin/Groups(ID=${g.ID},IsActiveEntity=false)`, { published: false }, adminAuth)
+      .catch(e => e.response ?? e);
+    expect(res.status).toBe(403);
+  });
+
+  it('lets a SuperAdmin flip published false→true', async () => {
+    const g = await createGroup('__TEST__ Pub Guard SA Flip', { published: false });
+    await project.post(
+      `/admin/Groups(ID=${g.ID},IsActiveEntity=true)/AdminService.draftEdit`, {}, superAuth);
+    const patched = await project.patch(
+      `/admin/Groups(ID=${g.ID},IsActiveEntity=false)`, { published: true }, superAuth);
+    expect(patched.status).toBe(200);
+    const activated = await project.post(
+      `/admin/Groups(ID=${g.ID},IsActiveEntity=false)/AdminService.draftActivate`, {}, superAuth);
+    expect([200, 201]).toContain(activated.status);
+    expect(activated.data.published).toBe(true);
+  });
+});
diff --git a/test/admin-slug-history.test.js b/test/admin-slug-history.test.js
index b9cff9c4e..a0da8285c 100644
--- a/test/admin-slug-history.test.js
+++ b/test/admin-slug-history.test.js
@@ -6,10 +6,9 @@ import { describe, it, expect, afterAll, beforeAll } from 'vitest';
 import cds from '@sap/cds';
 
 const project = cds.test('serve', '--project', '.', '--in-memory');
-// Renaming a published Group/Mission carries the `published: true` flag through
-// the activation PATCH, which a `_guardPublished` hook in admin-service.js
-// rejects for non-SuperAdmin users. Use superadmin so the rename succeeds and
-// we exercise the slug-history side effect.
+// Use superadmin throughout for simplicity. (Post-#2111 the `_guardPublished`
+// hook only rejects a genuine change to `published`, so a non-SuperAdmin rename
+// would also succeed — but superadmin keeps this test focused on slug history.)
 const adminAuth = { auth: { username: 'superadmin', password: 'superadmin' } };
 
 const TAG_ID = 'aaaaaaaa-3333-0000-0000-000000000001';
diff --git a/test/e2e/topics-discovery.test.js b/test/e2e/topics-discovery.test.js
deleted file mode 100644
index 289595935..000000000
--- a/test/e2e/topics-discovery.test.js
+++ /dev/null
@@ -1,171 +0,0 @@
-// e2e: topics front-door flow — gallery → cluster detail → concept → peer cluster.
-// Covers the /topics/ feature (Tasks 1-13 in the topics-discovery SDD).
-//
-// Flow:
-//   1. /topics/     renders gallery cards (baseof wraps content in <main>; h1 present)
-//   2. card click   navigates to /topics/<slug>/ and shows concepts list
-//   3. concept link goes to /concepts/<slug>/
-//   4. peer link    goes to another /topics/<slug>/
-//   5. (best-effort) #topics-map island mounts — skipped if WebGL is unavailable in CI
-//
-// Self-skips cleanly when SMOKE_BASE_URL / PLAYWRIGHT_BASE_URL is absent so that
-// `npm test` (unit suite) is never affected. Auth via Basic SMOKE_TECH_USER /
-// SMOKE_TECH_PASSWORD, same as every other spec in this tier (#1338).
-//
-// NOTE: the topics pages are statically baked by Hugo from hugo/data/topics_gallery.json.
-// In a fresh DEV deploy before the nightly job has run, the gallery may be empty (no cards).
-// The spec handles this gracefully: gallery and cluster assertions are skipped when the
-// gallery bakes empty, rather than failing the suite.
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
-import { hasBaseUrl } from './e2e.config.js';
-import { launchBrowser, newPage } from './_browser.js';
-
-describe.skipIf(!hasBaseUrl())('e2e: topics discovery front-door', () => {
-  let browser;
-  beforeAll(async () => {
-    browser = await launchBrowser();
-  });
-  afterAll(async () => {
-    await browser?.close();
-  });
-
-  it('/topics/ renders with a heading and gallery section or empty state', async () => {
-    const { context, page } = await newPage(browser, { authenticated: false });
-    try {
-      const response = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
-      expect(response, 'no response received for /topics/').not.toBeNull();
-      expect(response.status(), `unexpected status for /topics/`).toBe(200);
-
-      // baseof.html wraps all content in <main>; topics/list.html emits <h1>
-      await page.locator('main').first().waitFor({ state: 'visible', timeout: 15_000 });
-      expect(await page.locator('main').count()).toBeGreaterThan(0);
-      expect(await page.locator('h1').count(), 'topics page should render an h1').toBeGreaterThan(0);
-
-      // The gallery section OR the empty-state section must be present
-      const galleryCount = await page.locator('.topics-gallery, .topics-empty').count();
-      expect(galleryCount, 'expected .topics-gallery or .topics-empty section').toBeGreaterThan(0);
-    } finally {
-      await context.close();
-    }
-  });
-
-  it('a gallery card navigates to /topics/<slug>/ and shows the concepts section', async () => {
-    const { context, page } = await newPage(browser, { authenticated: false });
-    try {
-      const response = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
-      expect(response?.status(), 'topics gallery must return 200').toBe(200);
-
-      // If there are no cards (gallery baked empty), skip the navigation assertions
-      const firstCard = page.locator('.topics-card__link').first();
-      const cardCount = await firstCard.count();
-      if (cardCount === 0) {
-        // Gallery is empty on this env — not a failure, just skip the nav checks
-        return;
-      }
-
-      // Resolve the href before clicking so we can assert the URL
-      const cardHref = await firstCard.getAttribute('href');
-      expect(cardHref, 'card should have an href').toBeTruthy();
-
-      await Promise.all([
-        page.waitForURL(url => url.pathname === cardHref || url.pathname.startsWith('/topics/'), { timeout: 15_000 }),
-        firstCard.click(),
-      ]);
-
-      // Cluster detail page: single.html uses <article> wrapping when data is present,
-      // but always renders an <h1> (either the cluster title or "Topic not found").
-      await page.locator('h1').first().waitFor({ state: 'visible', timeout: 15_000 });
-      expect(await page.locator('h1').count(), 'cluster detail must have an h1').toBeGreaterThan(0);
-
-      // When cluster data is present the concepts section is rendered
-      // (may be .topics-detail__concepts or .topics-detail--missing)
-      const hasDetail = await page.locator('.topics-detail').count();
-      expect(hasDetail, 'expected .topics-detail on cluster page').toBeGreaterThan(0);
-    } finally {
-      await context.close();
-    }
-  });
-
-  it('a concept link on a cluster page resolves to /concepts/<slug>/', async () => {
-    const { context, page } = await newPage(browser, { authenticated: false });
-    try {
-      // Navigate to the first cluster that has concept links
-      const galleryResp = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
-      if (galleryResp?.status() !== 200) return;
-
-      const firstCard = page.locator('.topics-card__link').first();
-      if (await firstCard.count() === 0) return; // empty gallery — skip
-
-      const cardHref = await firstCard.getAttribute('href');
-      await Promise.all([
-        page.waitForURL(url => url.pathname.startsWith('/topics/'), { timeout: 15_000 }),
-        firstCard.click(),
-      ]);
-
-      // Look for a concept link (/concepts/<slug>/)
-      const conceptLink = page.locator('.topics-concepts-list__link').first();
-      if (await conceptLink.count() === 0) return; // cluster has no concepts rendered — skip
-
-      const conceptHref = await conceptLink.getAttribute('href');
-      expect(conceptHref, 'concept link should have an href').toBeTruthy();
-      expect(conceptHref, 'concept link should point to /concepts/').toContain('/concepts/');
-    } finally {
-      await context.close();
-    }
-  });
-
-  it('a peer-cluster link on a cluster page points to another /topics/<slug>/', async () => {
-    const { context, page } = await newPage(browser, { authenticated: false });
-    try {
-      const galleryResp = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
-      if (galleryResp?.status() !== 200) return;
-
-      const firstCard = page.locator('.topics-card__link').first();
-      if (await firstCard.count() === 0) return;
-
-      await Promise.all([
-        page.waitForURL(url => url.pathname.startsWith('/topics/'), { timeout: 15_000 }),
-        firstCard.click(),
-      ]);
-
-      // Peer cluster links — rendered in .topics-peers-list when peers exist
-      const peerLink = page.locator('.topics-peers-list__link').first();
-      if (await peerLink.count() === 0) return; // no peers in this cluster — skip
-
-      const peerHref = await peerLink.getAttribute('href');
-      expect(peerHref, 'peer link should have an href').toBeTruthy();
-      expect(peerHref, 'peer link should point to /topics/').toContain('/topics/');
-    } finally {
-      await context.close();
-    }
-  });
-
-  it('(best-effort) #topics-map island mount point is present on /topics/', async () => {
-    // This is a progressive-enhancement check: the island mounts when Sigma / WebGL
-    // is available. In CI WebGL is typically unavailable, so we only assert the mount
-    // point exists in the DOM — not that it has fully rendered children. The test is
-    // wrapped in try/catch so a WebGL crash never fails the suite.
-    const { context, page } = await newPage(browser, { authenticated: false });
-    try {
-      const response = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
-      if (response?.status() !== 200) return;
-
-      await page.locator('main').first().waitFor({ state: 'visible', timeout: 15_000 });
-
-      // The mount-point section is always rendered by the template (data-vue-island)
-      const mapSection = await page.locator('#topics-map, [data-vue-island="topics-map"]').count();
-      // Tolerate absence in case the layout changed; log but don't fail
-      if (mapSection === 0) {
-        console.warn('[topics-discovery e2e] #topics-map mount point not found — may not be deployed yet');
-        return;
-      }
-      expect(mapSection).toBeGreaterThan(0);
-      // Do NOT assert child nodes — WebGL may be absent in CI
-    } catch (err) {
-      // Swallow WebGL / canvas errors so they never fail the suite
-      console.warn('[topics-discovery e2e] map island best-effort check caught:', err?.message);
-    } finally {
-      await context.close();
-    }
-  });
-});
diff --git a/test/e2e/topics.spec.ts b/test/e2e/topics.spec.ts
new file mode 100644
index 000000000..542e9d5ce
--- /dev/null
+++ b/test/e2e/topics.spec.ts
@@ -0,0 +1,80 @@
+// test/e2e/topics.spec.ts
+//
+// e2e: tag-tree /topics/ pages.
+//
+// Three post-deploy checks driven via playwright-core inside plain vitest
+// (same pattern as topic-clusters-band.spec.ts and ui5-split.e2e.test.ts —
+// deliberately NOT @playwright/test, to avoid a second test-runner dep;
+// see _browser.js comment).
+//
+// Self-skips when PLAYWRIGHT_BASE_URL / SMOKE_BASE_URL is absent — so
+// `npm test` (unit suite) and credential-less local runs are never affected.
+//
+// Run against a deployed approuter:
+//   SMOKE_BASE_URL=https://… npx vitest run --project e2e test/e2e/topics.spec.ts
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { hasBaseUrl } from './e2e.config.js';
+import { launchBrowser, newPage } from './_browser.js';
+
+describe.skipIf(!hasBaseUrl())('e2e: /topics/ pages (tag-tree feature)', () => {
+  let browser: Awaited<ReturnType<typeof launchBrowser>>;
+
+  beforeAll(async () => {
+    browser = await launchBrowser();
+  });
+
+  afterAll(async () => {
+    await browser?.close();
+  });
+
+  it('topics index renders a tree and search links to navigator', async () => {
+    const { context, page } = await newPage(browser, { authenticated: false });
+    try {
+      const response = await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
+      expect(response, 'no response received').not.toBeNull();
+      expect(response!.status(), 'unexpected status for /topics/').toBe(200);
+
+      await expect(page.locator('#topics-tree-root')).toBeVisible();
+      await expect(page.locator('details summary').first()).toBeVisible();
+      await expect(page.locator('a[href="/tutorial-navigator/"]').first()).toBeVisible();
+      // Filter input presence/visibility — hook-coverage for #topics-filter-input.
+      // Presence check only; no live-typing interaction (would be flaky on deploy).
+      await expect(page.locator('#topics-filter-input')).toBeVisible();
+    } finally {
+      await context.close();
+    }
+  });
+
+  it('a topic leaf navigates to a detail page with tutorials', async () => {
+    const { context, page } = await newPage(browser, { authenticated: false });
+    try {
+      await page.goto('/topics/', { waitUntil: 'domcontentloaded' });
+      // Topic links live inside nested <details> elements. Open the first facet
+      // <details> so its children are in the DOM and actionable before clicking.
+      const firstDetails = page.locator('#topics-tree-root details').first();
+      await firstDetails.evaluate((el: HTMLDetailsElement) => { el.open = true; });
+      // Now wait for a visible topic link (up to 5 s); skip if none appears
+      // (e.g. tree empty or fully collapsed on this env).
+      const firstTopic = page.locator('#topics-tree-root a[href^="/topics/"]').first();
+      const visible = await firstTopic.isVisible().catch(() => false);
+      if (!visible) return; // graceful skip — no actionable topic link found
+      await firstTopic.click();
+      await page.waitForURL(/\/topics\/[a-z0-9-]+\//);
+      expect(page.url()).toMatch(/\/topics\/[a-z0-9-]+\//);
+      await expect(page.locator('h1')).toBeVisible();
+      await expect(page.locator('.topic-tutorials, main')).toBeVisible();
+    } finally {
+      await context.close();
+    }
+  });
+
+  it('/search/?q= redirects to the navigator', async () => {
+    const { context, page } = await newPage(browser, { authenticated: false });
+    try {
+      await page.goto('/search/?q=cap', { waitUntil: 'domcontentloaded' });
+      expect(page.url()).toMatch(/\/tutorial-navigator\//);
+    } finally {
+      await context.close();
+    }
+  });
+});
diff --git a/test/hybrid/backfill-categories-hana-resolution.test.js b/test/hybrid/backfill-categories-hana-resolution.test.js
new file mode 100644
index 000000000..772d20aaf
--- /dev/null
+++ b/test/hybrid/backfill-categories-hana-resolution.test.js
@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest';
+import cds from '@sap/cds';
+import { isSafeForWrites } from './_guard.js';
+
+// Runs against real HANA via `cds bind --exec` + the hybrid profile.
+// The seed is non-destructive (fills only empty seedDescription); still gated
+// behind isSafeForWrites() so it can never touch a prod container.
+const RUN = process.env.HYBRID_TESTS === 'true' && isSafeForWrites();
+
+cds.test('serve', '--project', '.', '--profile', 'hybrid');
+
+const NS = 'com.sap.developers.ims';
+
+(RUN ? describe : describe.skip)('hybrid: category backfill entity resolution against real HANA', () => {
+  // The backfill (scripts/backfill-categories.cjs) and classifier persist()
+  // regressed because they queried bare short-name strings ('Tutorials',
+  // 'TutorialCategories'), which resolve on local SQLite but emit bare
+  // TUTORIALS / TUTORIALCATEGORIES SQL against HANA (real tables are
+  // COM_SAP_DEVELOPERS_IMS_*). The fix resolves entity OBJECTS via a linked
+  // model. This test drives that exact load+link path (the standalone
+  // `cds bind --exec` branch, where cds.model is unset) against real HANA.
+
+  it('load+link resolution reaches the namespaced HANA tables (no "table not found")', async () => {
+    const db = await cds.connect.to('db');
+    const linked = cds.linked(await cds.load('*'));
+    const ents = linked.entities(NS);
+
+    for (const name of ['Tutorials', 'Missions', 'Groups', 'TutorialCategories', 'MissionCategories', 'GroupCategories']) {
+      const ent = ents[name];
+      expect(ent, `${name} must resolve from the linked model`).toBeTruthy();
+      // Fully-qualified so the emitted SQL targets COM_SAP_DEVELOPERS_IMS_<NAME>,
+      // not a bare unqualified table.
+      expect(ent.name).toBe(`${NS}.${name}`);
+      // The real assertion: a resolved-object SELECT executes on HANA. A bare
+      // short-name string here would throw "Could not find table/view <NAME>".
+      await expect(
+        db.run(SELECT.from(ent).columns('ID').limit(1)),
+      ).resolves.toBeDefined();
+    }
+  });
+
+  it('seedCategoryDescriptions runs against real HANA and leaves all seeds populated', async () => {
+    const { seedCategoryDescriptions } = await import('../../srv/lib/seed-category-descriptions.js');
+    const { CATEGORY_SEED_DESCRIPTIONS } = await import('../../srv/lib/category-seed-descriptions-defaults.js');
+    const db = await cds.connect.to('db');
+
+    const res = await seedCategoryDescriptions(db);
+    expect(res.total).toBeGreaterThan(0);
+    expect(res.updated).toBeGreaterThanOrEqual(0); // may already be seeded from a prior run
+
+    // Non-destructive + idempotent: after seeding, every category that has a
+    // default must carry a non-empty seedDescription, and a second run is a no-op.
+    const { Categories } = cds.linked(await cds.load('*')).entities(NS);
+    const rows = await db.run(SELECT.from(Categories).columns('slug', 'seedDescription'));
+    for (const row of rows) {
+      if (CATEGORY_SEED_DESCRIPTIONS[row.slug]) {
+        expect((row.seedDescription ?? '').trim().length).toBeGreaterThan(0);
+      }
+    }
+    const again = await seedCategoryDescriptions(db);
+    expect(again.updated).toBe(0);
+  });
+});
diff --git a/test/hybrid/kg-facet.test.js b/test/hybrid/kg-facet.test.js
new file mode 100644
index 000000000..69673d6ec
--- /dev/null
+++ b/test/hybrid/kg-facet.test.js
@@ -0,0 +1,17 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+cds.test('serve', '--project', '.', '--profile', 'hybrid')
+
+describe('KG facet reads (hybrid)', () => {
+  let admin
+  beforeAll(async () => { admin = await cds.connect.to('AdminService') })
+  it('reads a tutorial with KG associations expanded without error', async () => {
+    const t = await admin.run(SELECT.one.from('AdminService.Tutorials').columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    const links = await admin.run(SELECT.from('AdminService.TutorialConceptLinks').where({ tutorial_ID: t.ID }))
+    expect(Array.isArray(links)).toBe(true)          // may be empty in DEV — that's fine
+    const co = await admin.run(SELECT.from('AdminService.CoCompletions').limit(1))
+    expect(Array.isArray(co)).toBe(true)
+  })
+})
diff --git a/test/hybrid/media-exposure.test.js b/test/hybrid/media-exposure.test.js
new file mode 100644
index 000000000..30cf7ed6d
--- /dev/null
+++ b/test/hybrid/media-exposure.test.js
@@ -0,0 +1,16 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+cds.test('serve', '--project', '.', '--profile', 'hybrid')
+
+describe('media exposure (hybrid)', () => {
+  let admin
+  beforeAll(async () => { admin = await cds.connect.to('AdminService') })
+  it('reads images for a tutorial without LOB errors', async () => {
+    const t = await admin.run(SELECT.one.from('AdminService.Tutorials').columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    // metadata-only read (no BLOB mix — never select 'content')
+    const imgs = await admin.run(SELECT.from('AdminService.TutorialImages').columns('ID', 'sourceUrl', 'mimeType', 'byteSize').where({ slug: t.slug }))
+    expect(Array.isArray(imgs)).toBe(true)
+  })
+})
diff --git a/test/hybrid/publish-categories.test.js b/test/hybrid/publish-categories.test.js
new file mode 100644
index 000000000..aca607160
--- /dev/null
+++ b/test/hybrid/publish-categories.test.js
@@ -0,0 +1,26 @@
+// test/hybrid/publish-categories.test.js
+// Hybrid guard: verifies published tutorials populate categories from the classifier.
+// Requires: real HANA + cds bind --exec, and seed embeddings in Categories table.
+
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('publish populates categories (hybrid)', () => {
+  let db
+  beforeAll(async () => { db = await cds.connect.to('db') })
+
+  it('a freshly published tutorial has >= 0 category rows and no orphan write errors', async () => {
+    // Precondition: category seed embeddings must exist in this env.
+    const { Categories } = cds.entities('com.sap.developers.ims')
+    const seeds = await db.run(SELECT.from(Categories))
+    expect(seeds.length).toBeGreaterThan(0) // else run embedAllSeeds first
+
+    // Assert the classifier is reachable and idempotent for a known slug.
+    // (Use a slug known to exist in the bound DB.)
+    const { Tutorials, TutorialCategories } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    const rows = await db.run(SELECT.from(TutorialCategories).where({ tutorial_ID: t.ID }))
+    expect(Array.isArray(rows)).toBe(true)
+  })
+})
diff --git a/test/hybrid/publish-contributors.test.js b/test/hybrid/publish-contributors.test.js
new file mode 100644
index 000000000..2368ae948
--- /dev/null
+++ b/test/hybrid/publish-contributors.test.js
@@ -0,0 +1,23 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceContributorsForSlug } from '../../srv/lib/contributors-publish.js'
+
+cds.test('serve', '--project', '.', '--profile', 'hybrid')
+
+describe('contributors publish (hybrid)', () => {
+  let db
+  beforeAll(async () => { db = await cds.connect.to('db') })
+  it('links contributor rows to an existing tutorial by slug', async () => {
+    const { Tutorials, TutorialContributors } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    await replaceContributorsForSlug(db, t.slug, [
+      { login: 'octocat', name: 'Octo', email: 'o@x.com', avatarUrl: 'https://github.com/octocat.png' },
+    ])
+    const rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: t.ID, login: 'octocat' }))
+    expect(rows.length).toBe(1)
+    expect(rows[0].profileUrl).toBe('https://github.com/octocat')
+    // cleanup
+    await db.run(DELETE.from(TutorialContributors).where({ tutorial_ID: t.ID, login: 'octocat' }))
+  })
+})
diff --git a/test/hybrid/publish-validation-rules.test.js b/test/hybrid/publish-validation-rules.test.js
new file mode 100644
index 000000000..22e5e32ed
--- /dev/null
+++ b/test/hybrid/publish-validation-rules.test.js
@@ -0,0 +1,31 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+import { replaceValidationRulesForSlug } from '../../srv/lib/validation-rules-publish.js'
+
+cds.test('serve', '--project', '.', '--profile', 'hybrid')
+
+describe('validation rules publish (hybrid)', () => {
+  let db
+  beforeAll(async () => { db = await cds.connect.to('db') })
+  it('lands mixed AI + client rules for an existing slug', async () => {
+    const { Tutorials, TutorialValidationRules, ValidateAnswerSpecs } = cds.entities('com.sap.developers.ims')
+    const t = await db.run(SELECT.one.from(Tutorials).columns('ID', 'slug'))
+    expect(t).toBeTruthy()
+    try {
+      // Assert ValidateAnswerSpecs isolation: query count before
+      const beforeCount = await db.run(SELECT.from(ValidateAnswerSpecs).where({ tutorial_ID: t.ID, stepNumber: 99 }).columns(c => c`count(*) as cnt`)).then(r => r[0]?.cnt ?? 0)
+      await replaceValidationRulesForSlug(db, t.slug, [
+        { stepNumber: 99, questionId: 'vr-test-a', questionText: 'client', ruleType: 'single-choice', questionType: 'MCQ', choiceMode: 'single', options: '["A"]', correctAnswer: 'A', aiGrading: false },
+        { stepNumber: 99, questionId: 'vr-test-b', questionText: 'ai', ruleType: 'regex', questionType: 'TEXT', choiceMode: null, options: null, correctAnswer: null, aiGrading: true },
+      ])
+      const rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: t.ID, stepNumber: 99 }))
+      expect(rows.length).toBe(2)
+      // Assert ValidateAnswerSpecs isolation: count after should match before
+      const afterCount = await db.run(SELECT.from(ValidateAnswerSpecs).where({ tutorial_ID: t.ID, stepNumber: 99 }).columns(c => c`count(*) as cnt`)).then(r => r[0]?.cnt ?? 0)
+      expect(afterCount).toBe(beforeCount)
+    } finally {
+      // cleanup
+      await db.run(DELETE.from(TutorialValidationRules).where({ tutorial_ID: t.ID, stepNumber: 99 }))
+    }
+  })
+})
diff --git a/test/hybrid/topics-publish-serve.test.js b/test/hybrid/topics-publish-serve.test.js
new file mode 100644
index 000000000..83da483e5
--- /dev/null
+++ b/test/hybrid/topics-publish-serve.test.js
@@ -0,0 +1,133 @@
+// test/hybrid/topics-publish-serve.test.js
+//
+// Serve-path regression guard for the /content/topics/:slug route against real HANA.
+// This is NOT a publish-pipeline test — rows are hand-inserted so the test stays
+// focused on the serve path (route resolution, BLOB decompress, Content-Type,
+// afterAll teardown). Mirrors test/hybrid/page-publish-serve.test.js exactly.
+//
+// Leg A: hand-insert a topic-<slug> ContentFiles row (using a live tag slug
+//        drawn from /build/topics-tree so resolveTopicBySlug does NOT redirect),
+//        GET /content/topics/<slug> → 200 + HTML body contains marker.
+// Leg B: GET /build/topics-tree → 200 + non-empty tree; GET /build/topics/<slug>
+//        for a slug from the tree → 200 + non-empty payload.
+//
+// Invariant check: the route rewrites the URL slug to a `topic-<slug>` ContentFiles
+// key before calling serveHandler — confirmed in srv/server.js:584:
+//   req.params.slug = `topic-${lower}`;
+//   return serveHandler(req, res);
+import { describe, it, expect, afterAll } from 'vitest';
+import cds from '@sap/cds';
+import { gzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+
+const test = cds.test('serve', '--project', '.'); // hybrid: real HANA via cds bind --exec
+const NS = 'com.sap.developers.ims';
+
+// Recursively find the first leaf node that has a slug in the topics tree.
+function findLeafSlug(nodes) {
+  for (const node of nodes || []) {
+    if (node.slug) return node.slug;
+    if (Array.isArray(node.children)) {
+      const found = findLeafSlug(node.children);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+
+// Shared state — populated by the serve-path test, consumed by teardown.
+const state = { testVersion: null, prevActiveVersion: null, liveSlug: null };
+
+// Leg A: Serve-path round-trip — hand-inserts a committed topic row, then
+// verifies the CAP route resolves it correctly from HANA.
+describe('topics serve path: HANA regression guard (hybrid)', () => {
+  it('serves a published topic page with HTML mime from HANA', async (ctx) => {
+    const db = await cds.connect.to('db');
+    const { ContentFiles, ContentManifest } = cds.entities(NS);
+
+    // Discover a live tag slug so resolveTopicBySlug returns redirectTo:null.
+    // Without a real slug the route would 301-redirect to /topics/ before
+    // reaching serveHandler (by design — unknown slugs redirect, per spec).
+    const treeRes = await test.get('/build/topics-tree');
+    expect(treeRes.status).toBe(200);
+    const liveSlug = findLeafSlug(treeRes.data?.tree || []);
+    if (!liveSlug) {
+      // No live tags in this env — serve-path test is meaningless without one.
+      ctx.skip();
+      return;
+    }
+    state.liveSlug = liveSlug;
+
+    const html = `<!DOCTYPE html><html><body data-topic="${liveSlug}">topic:${liveSlug}</body></html>`;
+    // SELECT.one returns an object, not an array — drop .one to get an array.
+    const [{ maxv } = {}] = await db.run(SELECT.from(ContentManifest).columns({ func: 'max', args: [{ ref: ['version'] }], as: 'maxv' }));
+    state.testVersion = (maxv || 0) + 1;
+    // Capture the previously ACTIVE version so afterAll can restore it.
+    const [prev] = await db.run(SELECT.from(ContentManifest).where({ status: 'ACTIVE' }).columns('version').limit(1));
+    state.prevActiveVersion = prev?.version ?? null;
+    await db.run(INSERT.into(ContentManifest).entries({ version: state.testVersion, status: 'ACTIVE', fileCount: 1, changedSlugs: JSON.stringify([`topic-${liveSlug}`]) }));
+    await db.run(UPDATE(ContentManifest).set({ status: 'SUPERSEDED' }).where`version < ${state.testVersion}`);
+    const gz = gzipSync(Buffer.from(html));
+    await db.run(INSERT.into(ContentFiles).entries({
+      slug: `topic-${liveSlug}`, version: state.testVersion, content: gz,
+      contentHash: createHash('sha256').update(html).digest('hex'),
+      mimeType: 'text/html', sizeBytes: html.length, compressedBytes: gz.length,
+    }));
+    const res = await test.get(`/content/topics/${liveSlug}`);
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toContain('html');
+    expect(String(res.data)).toContain(`topic:${liveSlug}`);
+  });
+
+  afterAll(async () => {
+    if (state.testVersion == null) return;
+    const db = await cds.connect.to('db');
+    const { ContentFiles, ContentManifest } = cds.entities(NS);
+    // Remove the test ContentFiles row and manifest version we created.
+    if (state.liveSlug) {
+      await db.run(DELETE.from(ContentFiles).where({ slug: `topic-${state.liveSlug}`, version: state.testVersion }));
+    }
+    await db.run(DELETE.from(ContentManifest).where({ version: state.testVersion }));
+    // Restore the prior ACTIVE manifest that we superseded.
+    if (state.prevActiveVersion != null) {
+      await db.run(UPDATE(ContentManifest).set({ status: 'ACTIVE' }).where({ version: state.prevActiveVersion }));
+    }
+  });
+});
+
+// Leg B: Build-feed sanity — /build/topics-tree and /build/topics/:slug return
+// non-empty payloads from the live tag + KG data.
+describe('topics build feeds (hybrid)', () => {
+  it('/build/topics-tree returns 200 and a non-empty tree', async (ctx) => {
+    const res = await test.get('/build/topics-tree');
+    expect(res.status).toBe(200);
+    const body = res.data;
+    expect(body).toHaveProperty('tree');
+    if (!Array.isArray(body.tree) || body.tree.length === 0) {
+      // Visible skip — empty tree in this env (e.g. no TutorialTags data).
+      ctx.skip();
+      return;
+    }
+    expect(body.tree.length).toBeGreaterThan(0);
+  });
+
+  it('/build/topics/:slug returns 200 for a slug drawn from the tree', async (ctx) => {
+    const treeRes = await test.get('/build/topics-tree');
+    expect(treeRes.status).toBe(200);
+    const { tree } = treeRes.data;
+    if (!Array.isArray(tree) || tree.length === 0) {
+      ctx.skip();
+      return;
+    }
+    const slug = findLeafSlug(tree);
+    if (!slug) {
+      ctx.skip();
+      return;
+    }
+    const res = await test.get(`/build/topics/${slug}`);
+    expect(res.status).toBe(200);
+    const body = res.data;
+    expect(body).toHaveProperty('slug');
+    expect(body.slug).toBe(slug);
+  });
+});
diff --git a/test/smoke/pages-routes.smoke.test.js b/test/smoke/pages-routes.smoke.test.js
index 5fe7de811..f24e6d548 100644
--- a/test/smoke/pages-routes.smoke.test.js
+++ b/test/smoke/pages-routes.smoke.test.js
@@ -30,7 +30,7 @@ const describeIf = SMOKE_TARGET ? describe : describe.skip;
 // confirming the right page was served (not a fallback error page).
 const HTML_ROUTES = [
   { path: '/browse/',              marker: 'id="browse-results"'     },
-  { path: '/topics/',              marker: 'id="topics-map"'         },
+  { path: '/topics/',              marker: 'id="topics-tree-root"'   },
   { path: '/tutorial-navigator/', marker: 'id="tutorial-navigator"' },
   { path: '/developer-advocates/', marker: 'id="advocates-mount"'   },
   { path: '/devtoberfest/',        marker: 'id="devtoberfest-mount"' },
diff --git a/test/smoke/topics-route.smoke.test.js b/test/smoke/topics-route.smoke.test.js
new file mode 100644
index 000000000..ee364618e
--- /dev/null
+++ b/test/smoke/topics-route.smoke.test.js
@@ -0,0 +1,69 @@
+// test/smoke/topics-route.smoke.test.js
+//
+// Smoke tests for the tag-tree topics feature — CAP-served /topics/ routes.
+//
+// Tests:
+//   1. /topics/__definitely-not-a-real-slug__/ → NOT 200. Topics unknown slugs
+//      301 to /topics/ (resolveTopicBySlug redirect path), unlike /concepts/
+//      which 404s. fetchWithRetry uses redirect:'manual' so the client sees the
+//      raw 301 — the invariant is simply: a bogus slug must never resolve to a
+//      served page (status ≠ 200).
+//   2. /topics/ index → 200 (published BLOB or SSR-served by CAP via
+//      /content/topics-index; x-content-source assertion is best-effort)
+//   3. A live leaf slug derived from /build/topics-tree → 200 + body
+//      references the slug. ctx.skip() (VISIBLE skip) when tree is empty.
+//
+// Mirrors concepts-route.smoke.test.js structure exactly.
+import { describe, it, expect } from 'vitest';
+import { BASE_URL, SRV_URL, fetchWithRetry } from './smoke.config.js';
+
+describe('/topics/ route smoke', () => {
+  it('does not serve a non-existent topic slug as a page', async () => {
+    const r = await fetchWithRetry(`${BASE_URL}/topics/__definitely-not-a-real-slug__/`);
+    // Topics 301 unknown slugs to /topics/ (resolveTopicBySlug redirect), unlike
+    // concepts which 404. fetchWithRetry uses redirect:'manual', so assert the
+    // real invariant: a bogus slug must never resolve to a served page.
+    expect(r.status).not.toBe(200);
+  });
+
+  it('/topics/ index returns 200', async () => {
+    const r = await fetchWithRetry(`${BASE_URL}/topics/`, { redirect: 'follow' });
+    expect(r.status).toBe(200);
+    // x-content-source header presence is best-effort (route exposes it when
+    // the page is served from HANA; approuter-cached responses may not carry it).
+    const xcs = r.headers.get('x-content-source');
+    if (xcs !== null) {
+      expect(typeof xcs).toBe('string');
+    }
+  });
+
+  it('returns 200 for a known live topic slug', async (ctx) => {
+    const probe = await fetchWithRetry(`${SRV_URL}/build/topics-tree`);
+    expect(probe.status).toBe(200);
+    const body = await probe.json();
+    // Recursively find the first leaf node that has a slug.
+    function findLeafSlug(nodes) {
+      for (const node of nodes || []) {
+        if (node.slug) return node.slug;
+        if (Array.isArray(node.children)) {
+          const found = findLeafSlug(node.children);
+          if (found) return found;
+        }
+      }
+      return null;
+    }
+    const slug = findLeafSlug(body.tree || []);
+    if (!slug) {
+      // Visible skip — distinct from a passing assertion. Surfaces in CI as
+      // a skipped test, not a silent PASS. Matches concepts-route.smoke pattern.
+      ctx.skip();
+      return;
+    }
+    const r = await fetchWithRetry(`${BASE_URL}/topics/${slug}/`, { redirect: 'follow' });
+    expect(r.status).toBe(200);
+    const html = await r.text();
+    // Assert on slug (unescaped in <a href>), not label (HTML-escaped by Hugo
+    // template — would break for labels with & < > etc).
+    expect(html).toContain(`/topics/${slug}/`);
+  });
+});
diff --git a/test/unit/admin-facet-readability.test.js b/test/unit/admin-facet-readability.test.js
new file mode 100644
index 000000000..cf2f9d64b
--- /dev/null
+++ b/test/unit/admin-facet-readability.test.js
@@ -0,0 +1,108 @@
+// test/unit/admin-facet-readability.test.js
+//
+// Guards the three Tutorials Object-Page facet-readability fixes:
+//   1. Concepts Taught  — concept_ID FK shows the concept NAME (@Common.Text
+//      → concept/name, #TextOnly) instead of a raw GUID.
+//   2. Community         — communityId shows the LLM cluster LABEL when present
+//      (@Common.Text → labelInfo/label, #TextFirst), member slug as fallback.
+//   3. Images            — TutorialImages exposes virtual thumbUrl/viewUrl
+//      (the tutorial-system's own served-image URLs); thumbUrl is @UI.IsImageURL
+//      and the after('READ') handler fills both from sourceUrl.
+//
+// Two layers: CSN annotation guards (structural, so a future annotation edit
+// can't silently revert), plus a served runtime check of the URL enrichment.
+//
+// Auth: username='admin', password='admin' (mocked-auth convention).
+
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+
+const project = cds.test('serve', '--project', '.', '--in-memory');
+const ADMIN_AUTH = { auth: { username: 'admin', password: 'admin' } };
+const IMAGES = 'com.sap.developers.ims.TutorialImages';
+
+describe('admin facet readability — CSN annotation guards', () => {
+  let csn;
+  beforeAll(async () => {
+    csn = await cds.load(['srv', 'app', 'db']);
+  });
+
+  it('TutorialConceptLinks.concept carries @Common.Text: concept.name (#TextOnly)', () => {
+    const el = csn.definitions['AdminService.TutorialConceptLinks']?.elements?.concept;
+    expect(el, 'concept association should exist').toBeTruthy();
+    expect(el['@Common.Text']?.['=']).toBe('concept.name');
+    expect(el['@Common.TextArrangement']?.['#']).toBe('TextOnly');
+  });
+
+  it('KgCommunityMembers.communityId carries @Common.Text: labelInfo.label (#TextFirst)', () => {
+    const el = csn.definitions['AdminService.KgCommunityMembers']?.elements?.communityId;
+    expect(el, 'communityId should exist').toBeTruthy();
+    expect(el['@Common.Text']?.['=']).toBe('labelInfo.label');
+    expect(el['@Common.TextArrangement']?.['#']).toBe('TextFirst');
+  });
+
+  it('KgCommunityMembers exposes the labelInfo association to KgCommunityLabelInfo', () => {
+    const el = csn.definitions['AdminService.KgCommunityMembers']?.elements?.labelInfo;
+    expect(el, 'labelInfo association should exist').toBeTruthy();
+    expect(el.target).toBe('AdminService.KgCommunityLabelInfo');
+  });
+
+  it('TutorialImages exposes virtual thumbUrl/viewUrl; thumbUrl is @UI.IsImageURL', () => {
+    const els = csn.definitions['AdminService.TutorialImages']?.elements ?? {};
+    expect(els.thumbUrl?.virtual).toBe(true);
+    expect(els.viewUrl?.virtual).toBe(true);
+    expect(els.thumbUrl?.['@UI.IsImageURL']).toBe(true);
+  });
+});
+
+describe('after(READ, TutorialImages) — served-image URL enrichment', () => {
+  const SRC = 'https://github.com/sap-tutorials/Tutorials/raw/master/tutorials/foo/img/a b.png';
+
+  beforeAll(async () => {
+    await cds.run(
+      INSERT.into(IMAGES).entries(
+        {
+          ID: cds.utils.uuid(),
+          slug: 'facet-readability-test',
+          channel: 'prod',
+          sourceUrl: SRC,
+          mimeType: 'image/png',
+          byteSize: 1234,
+          contentHash: 'abc',
+        },
+        {
+          // Null sourceUrl → handler must skip enrichment (no crash, no URLs).
+          ID: cds.utils.uuid(),
+          slug: 'facet-readability-nosrc',
+          channel: 'prod',
+          sourceUrl: null,
+        }
+      )
+    );
+  });
+
+  it('fills thumbUrl (/img-cdn) and viewUrl (/content/image-source) from sourceUrl', async () => {
+    const res = await project.get(
+      `/admin/TutorialImages?$filter=slug eq 'facet-readability-test'`,
+      ADMIN_AUTH
+    );
+    expect(res.status).toBe(200);
+    const row = res.data.value[0];
+    expect(row).toBeTruthy();
+    const enc = encodeURIComponent(SRC);
+    expect(row.thumbUrl).toBe(`/img-cdn?u=${enc}`);
+    expect(row.viewUrl).toBe(`/content/image-source?u=${enc}`);
+  });
+
+  it('leaves thumbUrl/viewUrl unset when sourceUrl is null (no crash)', async () => {
+    const res = await project.get(
+      `/admin/TutorialImages?$filter=slug eq 'facet-readability-nosrc'`,
+      ADMIN_AUTH
+    );
+    expect(res.status).toBe(200);
+    const row = res.data.value[0];
+    expect(row).toBeTruthy();
+    expect(row.thumbUrl == null).toBe(true);
+    expect(row.viewUrl == null).toBe(true);
+  });
+});
diff --git a/test/unit/annotations-contributors.test.js b/test/unit/annotations-contributors.test.js
new file mode 100644
index 000000000..7e896f710
--- /dev/null
+++ b/test/unit/annotations-contributors.test.js
@@ -0,0 +1,13 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('Contributors LineItem', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('LineItem includes login column', () => {
+    const e = m.definitions['AdminService.TutorialContributors']
+    const li = e['@UI.LineItem']
+    const values = li.map((x) => x.Value?.['='] || x.Value)
+    expect(values).toContain('login')
+  })
+})
diff --git a/test/unit/annotations-freshness-facet.test.js b/test/unit/annotations-freshness-facet.test.js
new file mode 100644
index 000000000..aff71dbed
--- /dev/null
+++ b/test/unit/annotations-freshness-facet.test.js
@@ -0,0 +1,13 @@
+// test/unit/annotations-freshness-facet.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('Freshness reports facet', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('Tutorials has freshnessReports association', () => {
+    expect(m.definitions['AdminService.Tutorials'].elements.freshnessReports).toBeTruthy()
+  })
+  it('OP facets include FreshnessReportsFacet', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('FreshnessReportsFacet')
+  })
+})
diff --git a/test/unit/annotations-kg.test.js b/test/unit/annotations-kg.test.js
new file mode 100644
index 000000000..e436acf56
--- /dev/null
+++ b/test/unit/annotations-kg.test.js
@@ -0,0 +1,21 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('Knowledge Graph facets', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+
+  it('OP facets include KG facets', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('ConceptsTaughtFacet')
+    expect(ids).toContain('CoCompletionsFacet')
+    expect(ids).toContain('KgCommunityFacet')
+  })
+
+  it('concept links LineItem shows predicate + confidence', () => {
+    const li = m.definitions['AdminService.TutorialConceptLinks']['@UI.LineItem']
+    const vals = li.map((x) => x.Value?.['='] || x.Value)
+    expect(vals).toContain('predicate')
+    expect(vals).toContain('confidence')
+  })
+})
diff --git a/test/unit/annotations-media.test.js b/test/unit/annotations-media.test.js
new file mode 100644
index 000000000..d5e9a426a
--- /dev/null
+++ b/test/unit/annotations-media.test.js
@@ -0,0 +1,15 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('Media facet', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('OP facets include Media', () => {
+    const ids = m.definitions['AdminService.Tutorials']['@UI.Facets'].map((f) => f.ID)
+    expect(ids).toContain('MediaImagesFacet')
+    expect(ids).toContain('MediaAssetsFacet')
+  })
+  it('image LineItem shows sourceUrl + byteSize + mimeType', () => {
+    const li = m.definitions['AdminService.TutorialImages']['@UI.LineItem']
+    const vals = li.map((x) => x.Value?.['='] || x.Value)
+    for (const c of ['sourceUrl','byteSize','mimeType','contentHash']) expect(vals).toContain(c)
+  })
+})
diff --git a/test/unit/annotations-validation-rules.test.js b/test/unit/annotations-validation-rules.test.js
new file mode 100644
index 000000000..ed20f1b8f
--- /dev/null
+++ b/test/unit/annotations-validation-rules.test.js
@@ -0,0 +1,17 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('validation rules exposure + facet', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('AdminService exposes TutorialValidationRules read-only', () => {
+    expect(m.definitions['AdminService.TutorialValidationRules']).toBeTruthy()
+  })
+  it('Tutorials has validationRules association', () => {
+    expect(m.definitions['AdminService.Tutorials'].elements.validationRules).toBeTruthy()
+  })
+  it('OP facets include an All Validation Rules facet', () => {
+    const facets = m.definitions['AdminService.Tutorials']['@UI.Facets']
+    const ids = facets.map((f) => f.ID)
+    expect(ids).toContain('AllValidationRulesFacet')
+  })
+})
diff --git a/test/unit/collect-all-rules.test.js b/test/unit/collect-all-rules.test.js
new file mode 100644
index 000000000..389a95395
--- /dev/null
+++ b/test/unit/collect-all-rules.test.js
@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { collectAllRules } from '../../scripts/parsers/rules.js'
+
+describe('collectAllRules', () => {
+  it('includes non-AI MCQ rules with options + correctAnswer', () => {
+    const map = new Map([[1, [
+      { id: 'validate-1', question: 'Pick one', type: 'multiple-choice', options: ['A','B'], choiceMode: 'single', correctAnswer: 'A' },
+      { id: 'validate-1b', question: 'AI graded', type: 'text', aiGrading: true },
+    ]]])
+    // Single colon key format: `${stepNumber}:${q.id}` (confirmed in rules.ts line 244)
+    const ruleTypeMap = new Map([['1:validate-1', 'single-choice'], ['1:validate-1b', 'regex']])
+    const answerMap = new Map([['1:validate-1', 'A']])
+    const rows = collectAllRules(map, ruleTypeMap, answerMap)
+    expect(rows).toHaveLength(2)
+    const mcq = rows.find((r) => r.questionId === 'validate-1')
+    expect(mcq.aiGrading).toBe(false)
+    expect(mcq.questionType).toBe('MCQ')
+    expect(JSON.parse(mcq.options)).toEqual(['A','B'])
+    expect(mcq.correctAnswer).toBe('A')
+    const ai = rows.find((r) => r.questionId === 'validate-1b')
+    expect(ai.aiGrading).toBe(true)
+    expect(ai.correctAnswer).toBeNull()
+  })
+})
diff --git a/test/unit/contributors-publish.test.js b/test/unit/contributors-publish.test.js
new file mode 100644
index 000000000..c20558d0a
--- /dev/null
+++ b/test/unit/contributors-publish.test.js
@@ -0,0 +1,35 @@
+// test/unit/contributors-publish.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import path from 'node:path'
+import cds from '@sap/cds'
+import { replaceContributorsForSlug } from '../../srv/lib/contributors-publish.js'
+
+describe('replaceContributorsForSlug', () => {
+  let db
+  beforeAll(async () => {
+    await cds.deploy(path.join(process.cwd(), 'db', 'schema.cds')).to('sqlite::memory:')
+    db = cds.db
+  })
+
+  it('replaces rows for the slug and derives profileUrl', async () => {
+    const { Tutorials, TutorialContributors } = cds.entities('com.sap.developers.ims')
+    const ID = cds.utils.uuid()
+    await db.run(INSERT.into(Tutorials).entries({ ID, slug: 'demo', title: 'Demo' }))
+
+    await replaceContributorsForSlug(db, 'DEMO', [
+      { login: 'octocat', name: 'Octo Cat', email: 'o@x.com', avatarUrl: 'https://github.com/octocat.png' },
+    ])
+    let rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].login).toBe('octocat')
+    expect(rows[0].profileUrl).toBe('https://github.com/octocat')
+
+    // Second publish REPLACES, does not append.
+    await replaceContributorsForSlug(db, 'demo', [
+      { login: 'hubot', name: 'Hubot', email: 'h@x.com', avatarUrl: 'https://github.com/hubot.png' },
+    ])
+    rows = await db.run(SELECT.from(TutorialContributors).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].login).toBe('hubot')
+  })
+})
diff --git a/test/unit/contributors-sidecar.test.js b/test/unit/contributors-sidecar.test.js
new file mode 100644
index 000000000..76339a8b9
--- /dev/null
+++ b/test/unit/contributors-sidecar.test.js
@@ -0,0 +1,17 @@
+import { describe, it, expect } from 'vitest'
+import { buildContributorsSidecar } from '../../scripts/parsers/contributors-sidecar'
+
+describe('buildContributorsSidecar', () => {
+  it('lowercases slug and caps at 10', () => {
+    const contribs = Array.from({ length: 12 }, (_, i) => ({
+      login: `u${i}`, name: `N${i}`, email: `${i}@x.com`, avatarUrl: `a${i}`,
+    }))
+    const out = buildContributorsSidecar('My-Slug', contribs)
+    expect(out.slug).toBe('my-slug')
+    expect(out.contributors).toHaveLength(10)
+    expect(out.contributors[0]).toEqual({ login: 'u0', name: 'N0', email: '0@x.com', avatarUrl: 'a0' })
+  })
+  it('returns null when no contributors', () => {
+    expect(buildContributorsSidecar('s', [])).toBeNull()
+  })
+})
diff --git a/test/unit/devtoberfest-feed.test.js b/test/unit/devtoberfest-feed.test.js
index 5a28937d0..4b0303f2e 100644
--- a/test/unit/devtoberfest-feed.test.js
+++ b/test/unit/devtoberfest-feed.test.js
@@ -58,6 +58,19 @@ describe('devtoberfest-feed', () => {
     expect(out.sessions[0].sessionCode).toBe('DEV101');
   });
 
+  it('assembleFeed carries broadcastingPreference (Live/PreRecorded), null when unset', () => {
+    const sess = [
+      { ID: 's1', TITLE: 'Live one', TRACK_ID: 't1', STATUS: 'Confirmed', BROADCASTINGPREFERENCE: 'Live' },
+      { ID: 's2', TITLE: 'Recorded', TRACK_ID: 't1', STATUS: 'Confirmed', BROADCASTINGPREFERENCE: 'PreRecorded' },
+      { ID: 's3', TITLE: 'Unset', TRACK_ID: 't1', STATUS: 'Confirmed' },
+    ];
+    const out = assembleFeed({ sessions: sess, activities: [], tracks, editions: [], activeEditionId: null });
+    const byId = Object.fromEntries(out.sessions.map((s) => [s.id, s]));
+    expect(byId.s1.broadcastingPreference).toBe('Live');
+    expect(byId.s2.broadcastingPreference).toBe('PreRecorded');
+    expect(byId.s3.broadcastingPreference).toBe(null);
+  });
+
   it('normalizeSlugSet lowercases and dedupes', () => {
     const set = normalizeSlugSet([{ slug: 'Intro-Slug' }, { TASKSLUG: 'PUZ-1' }]);
     expect(set.has('intro-slug')).toBe(true);
diff --git a/test/unit/hugo/topics-layouts.test.ts b/test/unit/hugo/topics-layouts.test.ts
deleted file mode 100644
index cd20e0292..000000000
--- a/test/unit/hugo/topics-layouts.test.ts
+++ /dev/null
@@ -1,104 +0,0 @@
-// test/unit/hugo/topics-layouts.test.ts
-//
-// Template-source assertions for the topics gallery + cluster-detail layouts.
-// Pattern: readFileSync the layout source, assert on raw Go template text.
-// Matches the established project pattern (see topic-clusters-band.test.ts).
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import path from 'node:path';
-
-const listSrc = readFileSync(
-  path.resolve(import.meta.dirname, '../../../hugo/layouts/topics/list.html'),
-  'utf-8',
-);
-
-const singleSrc = readFileSync(
-  path.resolve(import.meta.dirname, '../../../hugo/layouts/topics/single.html'),
-  'utf-8',
-);
-
-describe('topics/list.html — gallery page', () => {
-  it('reads from site.Data.topics_gallery', () => {
-    expect(listSrc).toContain('site.Data.topics_gallery');
-  });
-
-  it('has a card grid with .topics-gallery or .topics-card CSS class', () => {
-    expect(listSrc).toMatch(/topics-gallery|topics-card/);
-  });
-
-  it('links cards to /topics/<slug>/', () => {
-    expect(listSrc).toContain('/topics/');
-  });
-
-  it('guards the grid with an empty-state check on .gallery', () => {
-    // Must have an `if` guard referencing gallery or its length
-    expect(listSrc).toMatch(/if .*gallery/);
-  });
-
-  it('has id="topics-map" mount point for the map island', () => {
-    expect(listSrc).toContain('id="topics-map"');
-  });
-
-  it('includes the topics-map island script unconditionally', () => {
-    expect(listSrc).toContain('topics-map.js');
-    // Must NOT be gated behind a {{ with site.Data.topics_map_bundle }} guard.
-    expect(listSrc).not.toContain('topics_map_bundle');
-  });
-
-  it('has a search form pointing to /search/', () => {
-    expect(listSrc).toContain('/search/');
-  });
-
-  it('shows concept chips from topConcepts', () => {
-    expect(listSrc).toContain('topConcepts');
-  });
-
-  it('cross-links to /explore/ from the hero', () => {
-    expect(listSrc).toContain('href="/explore/"');
-  });
-});
-
-describe('topics/single.html — cluster detail page', () => {
-  it('looks up cluster data from site.Data.topics_gallery.clusters', () => {
-    expect(singleSrc).toContain('site.Data.topics_gallery.clusters');
-  });
-
-  it('guards render on $c (missing cluster data does not crash)', () => {
-    expect(singleSrc).toMatch(/if \$c/);
-  });
-
-  it('switches heading and list type on orderMode', () => {
-    expect(singleSrc).toContain('orderMode');
-  });
-
-  it('uses <ol> for path order mode', () => {
-    expect(singleSrc).toContain('<ol');
-  });
-
-  it('uses <ul> for ranked order mode', () => {
-    expect(singleSrc).toContain('<ul');
-  });
-
-  it('links concepts to /concepts/<slug>/', () => {
-    expect(singleSrc).toContain('/concepts/');
-  });
-
-  it('has a peers section (connect)', () => {
-    expect(singleSrc).toMatch(/peers|connect/i);
-  });
-
-  it('links peer clusters to /topics/<slug>/', () => {
-    // peer links point back to /topics/
-    expect(singleSrc).toMatch(/href="\/topics\/[^"]*"/);
-  });
-
-  it('has a breadcrumb with Home and Topics links', () => {
-    expect(singleSrc).toContain('href="/"');
-    expect(singleSrc).toContain('href="/topics/"');
-  });
-
-  it('has data-focus-cluster attribute for mini-map island', () => {
-    expect(singleSrc).toContain('data-focus-cluster');
-  });
-});
diff --git a/test/unit/hugo/topics-map-vite-input.test.ts b/test/unit/hugo/topics-map-vite-input.test.ts
deleted file mode 100644
index 155758a2d..000000000
--- a/test/unit/hugo/topics-map-vite-input.test.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-describe('topics-map island is registered', () => {
-  it('has a rollup input entry', () => {
-    const cfg = readFileSync('hugo-apps/vite.config.ts', 'utf-8');
-    expect(cfg).toMatch(/['"]topics-map['"]\s*:\s*resolve\(__dirname,\s*['"]src\/topics-map\/main\.ts['"]\)/);
-  });
-});
diff --git a/test/unit/ingest-bytesize.test.js b/test/unit/ingest-bytesize.test.js
new file mode 100644
index 000000000..ba19bc0f7
--- /dev/null
+++ b/test/unit/ingest-bytesize.test.js
@@ -0,0 +1,46 @@
+// test/unit/ingest-bytesize.test.js
+//
+// Verifies that byteSize = buffer.length is persisted on the parent row when
+// image-store.cjs / attachment-store.cjs put() is called with a byteSize option.
+//
+// Run: npx vitest run --project unit test/unit/ingest-bytesize.test.js
+//
+// Boot full CAP server in-memory (SQLite). cds.test registers its own
+// beforeAll/afterAll hooks at this scope so all it() blocks run after boot.
+
+import { describe, it, expect } from 'vitest'
+import cds from '@sap/cds'
+import { createRequire } from 'node:module'
+
+const require = createRequire(import.meta.url)
+
+cds.test('serve', '--project', '.', '--in-memory')
+
+const imageStore = require('../../srv/lib/image-store.cjs')
+const attachmentStore = require('../../srv/lib/attachment-store.cjs')
+
+describe('image store persists byteSize', () => {
+  it('stores buffer.length as byteSize on the TutorialImages row', async () => {
+    const buf = Buffer.from('hello world')
+    await imageStore.put('https://raw.example/img.png', {
+      buffer: buf, mimeType: 'image/png', contentHash: 'abc123',
+      slug: 'demo', channel: 'prod', byteSize: buf.length,
+    })
+    const { TutorialImages } = cds.entities('com.sap.developers.ims')
+    const row = await SELECT.one.from(TutorialImages).where({ sourceUrl: 'https://raw.example/img.png' })
+    expect(Number(row.byteSize)).toBe(11)
+  })
+})
+
+describe('attachment store persists byteSize', () => {
+  it('stores buffer.length as byteSize on the TutorialAssets row', async () => {
+    const buf = Buffer.from('hello world')
+    await attachmentStore.put('https://raw.example/file.txt', {
+      buffer: buf, mimeType: 'text/plain', contentHash: 'def456',
+      slug: 'demo', channel: 'prod', filename: 'file.txt', byteSize: buf.length,
+    })
+    const { TutorialAssets } = cds.entities('com.sap.developers.ims')
+    const row = await SELECT.one.from(TutorialAssets).where({ sourceUrl: 'https://raw.example/file.txt' })
+    expect(Number(row.byteSize)).toBe(11)
+  })
+})
diff --git a/test/unit/install-notify-workflows.test.ts b/test/unit/install-notify-workflows.test.ts
index 84a98228c..7b234aed9 100644
--- a/test/unit/install-notify-workflows.test.ts
+++ b/test/unit/install-notify-workflows.test.ts
@@ -392,3 +392,30 @@ describe('PROD notify template branch trigger (regression guard)', () => {
     expect(template).not.toMatch(/branches:\s*\[\s*main\s*\]/)
   })
 })
+
+describe('QA notify template branch trigger (regression guard)', () => {
+  // -Contribution repos are ALSO a mixture of `main`- and `master`-default
+  // branches (Tutorials-Contribution defaults to `master`). The QA template
+  // MUST scope the push trigger to the default branch(es) — WITHOUT a branches:
+  // filter it fires on EVERY branch push (e.g. the devtoberfest validation-
+  // tutorial bot's `validation-tutorial/*` branches), dispatching a QA rebuild
+  // for a slug that exists only on that branch; QA discovery reads the default
+  // branch, so the slug is a phantom and the rebuild hard-fails "unknown slug
+  // in filter" (tutorials-ims#2097). Keep this in parity with the PROD guard.
+  const template = readFileSync(
+    join(__dirname, '..', '..', '.github', 'workflows', 'notify-qa.yml.template'),
+    'utf8',
+  )
+
+  it('fires on both master and main', () => {
+    expect(template).toMatch(/branches:\s*\[\s*master\s*,\s*main\s*\]/)
+  })
+
+  it('does not ship a main-only trigger', () => {
+    expect(template).not.toMatch(/branches:\s*\[\s*main\s*\]/)
+  })
+
+  it('ships a branches filter (never an unfiltered push trigger)', () => {
+    expect(template).toMatch(/branches:/)
+  })
+})
diff --git a/test/unit/kg-community-link.test.js b/test/unit/kg-community-link.test.js
new file mode 100644
index 000000000..2406fa4fd
--- /dev/null
+++ b/test/unit/kg-community-link.test.js
@@ -0,0 +1,13 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('community label reachable', () => {
+  let m
+  beforeAll(async () => {
+    m = await cds.load('*')
+  })
+  it('Tutorials exposes community membership or virtual label', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.communityMembership || t.communityLabel).toBeTruthy()
+  })
+})
diff --git a/test/unit/kg-exposure.test.js b/test/unit/kg-exposure.test.js
new file mode 100644
index 000000000..1246b8c50
--- /dev/null
+++ b/test/unit/kg-exposure.test.js
@@ -0,0 +1,17 @@
+// test/unit/kg-exposure.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('KG exposure on AdminService', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('exposes concept links, rank, co-completions read-only', () => {
+    expect(m.definitions['AdminService.TutorialConceptLinks']).toBeTruthy()
+    expect(m.definitions['AdminService.TutorialRank']).toBeTruthy()
+    expect(m.definitions['AdminService.CoCompletions']).toBeTruthy()
+  })
+  it('Tutorials carries conceptLinks / rank / coCompletions', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.conceptLinks).toBeTruthy()
+    expect(t.rank).toBeTruthy()
+    expect(t.coCompletions).toBeTruthy()
+  })
+})
diff --git a/test/unit/media-exposure.test.js b/test/unit/media-exposure.test.js
new file mode 100644
index 000000000..e5de747cc
--- /dev/null
+++ b/test/unit/media-exposure.test.js
@@ -0,0 +1,14 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('media exposure', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('exposes images + assets read-only', () => {
+    expect(m.definitions['AdminService.TutorialImages']).toBeTruthy()
+    expect(m.definitions['AdminService.TutorialAssets']).toBeTruthy()
+  })
+  it('Tutorials has images + assets associations', () => {
+    const t = m.definitions['AdminService.Tutorials'].elements
+    expect(t.images).toBeTruthy()
+    expect(t.assets).toBeTruthy()
+  })
+})
diff --git a/test/unit/page-key-map.test.js b/test/unit/page-key-map.test.js
index c0cc19995..9fa07101e 100644
--- a/test/unit/page-key-map.test.js
+++ b/test/unit/page-key-map.test.js
@@ -7,7 +7,7 @@ describe('page-key-map', () => {
   it('maps in-scope routes to page- keys', () => {
     expect(pageKeyForPath('/')).toBe('page-index');
     expect(pageKeyForPath('/browse/')).toBe('page-browse');
-    expect(pageKeyForPath('/topics/')).toBe('page-topics');
+    expect(pageKeyForPath('/topics/')).toBeNull(); // /topics/ now served by CAP dynamic route, not a page blob
     expect(pageKeyForPath('/tutorial-navigator/')).toBe('page-tutorial-navigator');
     expect(pageKeyForPath('/developer-advocates/')).toBe('page-developer-advocates');
     expect(pageKeyForPath('/devtoberfest/')).toBe('page-devtoberfest');
diff --git a/test/unit/publish-category-selfheal.test.js b/test/unit/publish-category-selfheal.test.js
new file mode 100644
index 000000000..8ff589d3a
--- /dev/null
+++ b/test/unit/publish-category-selfheal.test.js
@@ -0,0 +1,39 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+// vi.mock is hoisted to the top of the file by Vitest, so the factory runs
+// before any const declarations. vi.hoisted() lets us declare classifySpy in
+// a way that is also hoisted, keeping the reference valid inside the factory.
+const classifySpy = vi.hoisted(() => vi.fn().mockResolvedValue(undefined))
+vi.mock('../../srv/lib/category-classifier.js', () => ({
+  classifyAndPersist: classifySpy,
+}))
+
+import { classifyTouchedTutorials } from '../../srv/lib/content-publish-session.js'
+
+describe('publish category self-heal', () => {
+  beforeEach(() => classifySpy.mockClear())
+
+  it('classifies every touched tutorial id, fire-and-forget', async () => {
+    await classifyTouchedTutorials(['id-a', 'id-b'])
+    expect(classifySpy).toHaveBeenCalledTimes(2)
+    expect(classifySpy).toHaveBeenCalledWith('tutorial', 'id-a')
+    expect(classifySpy).toHaveBeenCalledWith('tutorial', 'id-b')
+  })
+
+  it('never rejects even if a classification throws', async () => {
+    classifySpy.mockRejectedValueOnce(new Error('boom'))
+    await expect(classifyTouchedTutorials(['id-a'])).resolves.toBeUndefined()
+  })
+
+  it('skips self-heal for a bulk publish (> 25 tutorials) so it cannot stampede', async () => {
+    const bulk = Array.from({ length: 26 }, (_, i) => `id-${i}`)
+    await classifyTouchedTutorials(bulk)
+    expect(classifySpy).not.toHaveBeenCalled()
+  })
+
+  it('still classifies an at-threshold incremental publish (25 tutorials)', async () => {
+    const ids = Array.from({ length: 25 }, (_, i) => `id-${i}`)
+    await classifyTouchedTutorials(ids)
+    expect(classifySpy).toHaveBeenCalledTimes(25)
+  })
+})
diff --git a/test/unit/publish-contributors-client.test.js b/test/unit/publish-contributors-client.test.js
new file mode 100644
index 000000000..19ca2bf5d
--- /dev/null
+++ b/test/unit/publish-contributors-client.test.js
@@ -0,0 +1,25 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { publishContributors } from '../../scripts/publish/publish-contributors'
+
+describe('publishContributors client', () => {
+  let dir
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'contrib-'))
+    writeFileSync(join(dir, 'demo.contributors.json'),
+      JSON.stringify({ slug: 'demo', contributors: [{ login: 'octocat', name: 'O', email: 'o@x', avatarUrl: 'a' }] }))
+    global.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ ok: true, count: 1 }) })
+  })
+  afterEach(() => { vi.restoreAllMocks() })
+
+  it('POSTs each sidecar to the endpoint', async () => {
+    const res = await publishContributors({ cacheDir: dir, baseUrl: 'http://x', apiKey: 'k' })
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    const [url, opts] = global.fetch.mock.calls[0]
+    expect(url).toBe('http://x/content/publish-contributors')
+    expect(JSON.parse(opts.body).slug).toBe('demo')
+    expect(res.published).toBe(1)
+  })
+})
diff --git a/test/unit/publish-validation-rules-client.test.js b/test/unit/publish-validation-rules-client.test.js
new file mode 100644
index 000000000..2e110e33c
--- /dev/null
+++ b/test/unit/publish-validation-rules-client.test.js
@@ -0,0 +1,21 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'; import { tmpdir } from 'node:os'
+import { publishValidationRules } from '../../scripts/publish/publish-validation-rules'
+
+describe('publishValidationRules client', () => {
+  let dir
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'vr-'))
+    writeFileSync(join(dir, 'demo.validation-rules.json'),
+      JSON.stringify({ slug: 'demo', rules: [{ stepNumber: 1, questionId: 'validate-1' }] }))
+    global.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ ok: true }) })
+  })
+  afterEach(() => vi.restoreAllMocks())
+  it('POSTs each sidecar', async () => {
+    const res = await publishValidationRules({ cacheDir: dir, baseUrl: 'http://x', apiKey: 'k' })
+    expect(global.fetch).toHaveBeenCalledTimes(1)
+    expect(global.fetch.mock.calls[0][0]).toBe('http://x/content/publish-validation-rules')
+    expect(res.published).toBe(1)
+  })
+})
diff --git a/test/unit/schema-contributors.test.js b/test/unit/schema-contributors.test.js
new file mode 100644
index 000000000..be6d96357
--- /dev/null
+++ b/test/unit/schema-contributors.test.js
@@ -0,0 +1,14 @@
+// test/unit/schema-contributors.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+
+describe('TutorialContributors schema', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('has GitHub link columns', () => {
+    const e = m.definitions['com.sap.developers.ims.TutorialContributors']
+    expect(e.elements.login).toBeTruthy()
+    expect(e.elements.avatarUrl).toBeTruthy()
+    expect(e.elements.profileUrl).toBeTruthy()
+  })
+})
diff --git a/test/unit/schema-media.test.js b/test/unit/schema-media.test.js
new file mode 100644
index 000000000..47c967e7e
--- /dev/null
+++ b/test/unit/schema-media.test.js
@@ -0,0 +1,9 @@
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('media byteSize', () => {
+  let m; beforeAll(async () => { m = await cds.load('*') })
+  it('images + assets have byteSize', () => {
+    expect(m.definitions['com.sap.developers.ims.TutorialImages'].elements.byteSize).toBeTruthy()
+    expect(m.definitions['com.sap.developers.ims.TutorialAssets'].elements.byteSize).toBeTruthy()
+  })
+})
diff --git a/test/unit/schema-validation-rules.test.js b/test/unit/schema-validation-rules.test.js
new file mode 100644
index 000000000..43f892399
--- /dev/null
+++ b/test/unit/schema-validation-rules.test.js
@@ -0,0 +1,13 @@
+// test/unit/schema-validation-rules.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import cds from '@sap/cds'
+describe('TutorialValidationRules schema', () => {
+  let m
+  beforeAll(async () => { m = await cds.load('*') })
+  it('exists with expected elements', () => {
+    const e = m.definitions['com.sap.developers.ims.TutorialValidationRules']
+    expect(e).toBeTruthy()
+    for (const k of ['stepNumber','questionId','questionText','ruleType','questionType','choiceMode','options','correctAnswer','aiGrading'])
+      expect(e.elements[k]).toBeTruthy()
+  })
+})
diff --git a/test/unit/scripts/fetch-topics-gallery.test.ts b/test/unit/scripts/fetch-topics-gallery.test.ts
deleted file mode 100644
index 138e071b8..000000000
--- a/test/unit/scripts/fetch-topics-gallery.test.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { writeTopicsGallery } from '../../../scripts/fetch-topics-gallery';
-import * as fs from 'node:fs';
-
-vi.mock('node:fs', async (orig) => ({
-  ...(await orig<typeof fs>()),
-  writeFileSync: vi.fn(),
-  mkdirSync: vi.fn(),
-  readdirSync: vi.fn(() => [] as string[]),
-  unlinkSync: vi.fn(),
-}));
-
-describe('writeTopicsGallery', () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it('writes the fetched payload to hugo/data/topics_gallery.json', async () => {
-    const payload = { gallery: [{ slug: 'x', label: 'X' }], clusters: {}, buildAt: 'now', error: null };
-    globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => payload } as any);
-    await writeTopicsGallery('http://localhost:4004');
-    const calls = (fs.writeFileSync as any).mock.calls;
-    const jsonCall = calls.find((c: any[]) => String(c[0]).match(/topics_gallery\.json$/));
-    expect(jsonCall).toBeTruthy();
-    expect(JSON.parse(jsonCall[1]).gallery[0].slug).toBe('x');
-  });
-
-  it('writes an empty fail-open payload when the fetch throws', async () => {
-    globalThis.fetch = vi.fn().mockRejectedValue(new Error('down'));
-    await writeTopicsGallery('http://localhost:4004');
-    const calls = (fs.writeFileSync as any).mock.calls;
-    const jsonCall = calls.find((c: any[]) => String(c[0]).match(/topics_gallery\.json$/));
-    expect(JSON.parse(jsonCall[1]).error).toBe('fetch_failed');
-    expect(JSON.parse(jsonCall[1]).gallery).toEqual([]);
-  });
-
-  it('writes a content stub for each cluster key', async () => {
-    const payload = {
-      gallery: [],
-      clusters: {
-        'cap-fundamentals': { label: 'CAP Fundamentals', rationale: 'r', memberCount: 2, tutorialCount: 5, orderMode: 'path', concepts: [], peers: [] },
-        'btp-basics': { label: 'BTP Basics', rationale: 'r2', memberCount: 1, tutorialCount: 3, orderMode: 'ranked', concepts: [], peers: [] },
-      },
-      buildAt: 'now',
-      error: null,
-    };
-    globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => payload } as any);
-    await writeTopicsGallery('http://localhost:4004');
-    const calls = (fs.writeFileSync as any).mock.calls;
-    const stubPaths = calls.map((c: any[]) => String(c[0])).filter((p: string) => p.match(/topics[/\\].*\.md$/));
-    expect(stubPaths.some((p: string) => p.match(/cap-fundamentals\.md$/))).toBe(true);
-    expect(stubPaths.some((p: string) => p.match(/btp-basics\.md$/))).toBe(true);
-  });
-
-  it('stub content has correct front matter fields', async () => {
-    const payload = {
-      gallery: [],
-      clusters: {
-        'x': { label: 'My Topic', rationale: 'r', memberCount: 1, tutorialCount: 1, orderMode: 'path', concepts: [], peers: [] },
-      },
-      buildAt: 'now',
-      error: null,
-    };
-    globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => payload } as any);
-    await writeTopicsGallery('http://localhost:4004');
-    const calls = (fs.writeFileSync as any).mock.calls;
-    const stubCall = calls.find((c: any[]) => String(c[0]).match(/[/\\]x\.md$/));
-    expect(stubCall).toBeTruthy();
-    const content = stubCall[1] as string;
-    expect(content).toContain('title: "My Topic"');
-    expect(content).toContain('type: topics');
-    expect(content).toContain('layout: single');
-    expect(content).toContain('cluster: "x"');
-  });
-
-  it('removes stale .md stubs (except _index.md) before writing new ones', async () => {
-    // Simulate existing stale stub
-    (fs.readdirSync as any).mockReturnValue(['stale-cluster.md', '_index.md', 'another-stale.md']);
-    const payload = { gallery: [], clusters: {}, buildAt: 'now', error: null };
-    globalThis.fetch = vi.fn().mockResolvedValue({ ok: true, json: async () => payload } as any);
-    await writeTopicsGallery('http://localhost:4004');
-    const unlinkCalls = (fs.unlinkSync as any).mock.calls.map((c: any[]) => String(c[0]));
-    expect(unlinkCalls.some((p: string) => p.match(/stale-cluster\.md$/))).toBe(true);
-    expect(unlinkCalls.some((p: string) => p.match(/another-stale\.md$/))).toBe(true);
-    // _index.md must NOT be deleted
-    expect(unlinkCalls.some((p: string) => p.match(/_index\.md$/))).toBe(false);
-  });
-});
diff --git a/test/unit/search-redirect.test.js b/test/unit/search-redirect.test.js
new file mode 100644
index 000000000..5bb34e455
--- /dev/null
+++ b/test/unit/search-redirect.test.js
@@ -0,0 +1,95 @@
+import { describe, it, expect } from 'vitest'
+import { createRequire } from 'node:module'
+
+// Approuter-native CJS module (like sitemap-index-redirect / security-txt).
+const require = createRequire(import.meta.url)
+const {
+  searchRedirectHandler,
+  matchSearchUrl,
+  NAVIGATOR_PATH,
+} = require('../../approuter/lib/search-redirect.js')
+
+// Minimal (req, res, next) mock, same shape as sitemap-index-redirect.test.js.
+function mockRes() {
+  return {
+    statusCode: null,
+    headers: null,
+    body: null,
+    writeHead(status, headers) { this.statusCode = status; this.headers = headers; return this },
+    end(payload) { this.body = payload; return this },
+  }
+}
+
+describe('matchSearchUrl', () => {
+  it('maps the bare /search entry point to the navigator', () => {
+    expect(matchSearchUrl('/search')).toBe('/tutorial-navigator/')
+    expect(matchSearchUrl('/search/')).toBe('/tutorial-navigator/')
+  })
+
+  it('preserves the query string', () => {
+    expect(matchSearchUrl('/search?q=cap')).toBe('/tutorial-navigator/?q=cap')
+    expect(matchSearchUrl('/search/?q=cap')).toBe('/tutorial-navigator/?q=cap')
+    expect(matchSearchUrl('/search?q=a&tag=b')).toBe('/tutorial-navigator/?q=a&tag=b')
+  })
+
+  it('does NOT match deeper /search/<path> URLs (those proxy to srv-api)', () => {
+    expect(matchSearchUrl('/search/foo')).toBeNull()
+    expect(matchSearchUrl('/search/tutorials.json')).toBeNull()
+    expect(matchSearchUrl('/search/?q=cap'.replace('/?', '/x?'))).toBeNull() // '/searchx?...'
+  })
+
+  it('ignores unrelated / lookalike paths', () => {
+    expect(matchSearchUrl('/searching')).toBeNull()
+    expect(matchSearchUrl('/foo/search')).toBeNull()
+    expect(matchSearchUrl('/tutorials-qa/search')).toBeNull()
+  })
+
+  it('handles non-string / empty input defensively', () => {
+    expect(matchSearchUrl('')).toBeNull()
+    expect(matchSearchUrl(undefined)).toBeNull()
+    expect(matchSearchUrl(null)).toBeNull()
+  })
+})
+
+describe('searchRedirectHandler — approuter middleware', () => {
+  it('301s /search to the navigator with a 1-day cache', () => {
+    const res = mockRes()
+    let nexted = false
+    searchRedirectHandler({ method: 'GET', url: '/search', headers: {} }, res, () => { nexted = true })
+    expect(nexted).toBe(false)
+    expect(res.statusCode).toBe(301)
+    expect(res.headers.Location).toBe(NAVIGATOR_PATH)
+    expect(res.headers['Cache-Control']).toMatch(/max-age=86400/)
+    expect(res.body).toBeUndefined()
+  })
+
+  it('301s /search?q=cap preserving the query', () => {
+    const res = mockRes()
+    searchRedirectHandler({ method: 'GET', url: '/search?q=cap', headers: {} }, res, () => {})
+    expect(res.statusCode).toBe(301)
+    expect(res.headers.Location).toBe('/tutorial-navigator/?q=cap')
+  })
+
+  it('answers HEAD with the same 301', () => {
+    const res = mockRes()
+    searchRedirectHandler({ method: 'HEAD', url: '/search', headers: {} }, res, () => {})
+    expect(res.statusCode).toBe(301)
+    expect(res.headers.Location).toBe(NAVIGATOR_PATH)
+  })
+
+  it('passes /search/<path> through untouched (proxied to srv-api downstream)', () => {
+    const res = mockRes()
+    let nexted = false
+    searchRedirectHandler({ method: 'GET', url: '/search/tutorials.json', headers: {} }, res, () => { nexted = true })
+    expect(nexted).toBe(true)
+    expect(res.statusCode).toBeNull()
+  })
+
+  it('passes through non-GET/HEAD methods', () => {
+    const res = mockRes()
+    let nexted = false
+    searchRedirectHandler({ method: 'POST', url: '/search', headers: {} }, res, () => { nexted = true })
+    expect(nexted).toBe(true)
+    expect(res.statusCode).toBeNull()
+  })
+})
diff --git a/test/unit/seed-category-descriptions.test.js b/test/unit/seed-category-descriptions.test.js
new file mode 100644
index 000000000..bfa539348
--- /dev/null
+++ b/test/unit/seed-category-descriptions.test.js
@@ -0,0 +1,82 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import cds from '@sap/cds';
+import { seedCategoryDescriptions } from '../../srv/lib/seed-category-descriptions.js';
+import { CATEGORY_SEED_DESCRIPTIONS } from '../../srv/lib/category-seed-descriptions-defaults.js';
+
+cds.test('serve', '--project', '.', '--in-memory');
+
+// NOTE: the boot seed (srv/server.js) is VITEST-gated, so category
+// seedDescriptions are NOT auto-filled here — every test drives
+// seedCategoryDescriptions(db) explicitly. Categories rows themselves come from
+// db/data/com.sap.developers.ims-Categories.csv (ID/slug/label/sortOrder), which
+// loads into the in-memory DB; their seedDescription starts null.
+
+describe('CATEGORY_SEED_DESCRIPTIONS (defaults integrity)', () => {
+  it('has non-empty descriptions and keys match the shipped category slugs', async () => {
+    const db = await cds.connect.to('db');
+    const { Categories } = cds.entities('com.sap.developers.ims');
+    const rows = await db.run(SELECT.from(Categories).columns('slug'));
+    const csvSlugs = new Set(rows.map((r) => r.slug));
+
+    const defaultSlugs = Object.keys(CATEGORY_SEED_DESCRIPTIONS);
+    expect(defaultSlugs.length).toBe(rows.length); // one default per shipped category
+    for (const slug of defaultSlugs) {
+      expect(csvSlugs.has(slug), `default slug '${slug}' not in Categories.csv`).toBe(true);
+      const text = CATEGORY_SEED_DESCRIPTIONS[slug];
+      expect(typeof text).toBe('string');
+      expect(text.trim().length).toBeGreaterThan(40); // rich enough to embed
+    }
+  });
+});
+
+describe('seedCategoryDescriptions (idempotent, non-destructive boot seed)', () => {
+  let db;
+  let Categories;
+  beforeAll(async () => {
+    db = await cds.connect.to('db');
+    ({ Categories } = cds.entities('com.sap.developers.ims'));
+  });
+
+  it('fills every empty seedDescription on first run', async () => {
+    const res = await seedCategoryDescriptions(db);
+    expect(res.total).toBe(Object.keys(CATEGORY_SEED_DESCRIPTIONS).length);
+    expect(res.updated).toBe(res.total); // all started empty
+
+    const rows = await db.run(SELECT.from(Categories).columns('slug', 'seedDescription'));
+    for (const row of rows) {
+      expect(row.seedDescription).toBe(CATEGORY_SEED_DESCRIPTIONS[row.slug]);
+    }
+  });
+
+  it('is idempotent — a second run updates nothing', async () => {
+    const res = await seedCategoryDescriptions(db);
+    expect(res.updated).toBe(0);
+  });
+
+  it('never overwrites an admin-edited seedDescription', async () => {
+    const edited = 'ADMIN EDITED SEED — do not clobber';
+    const target = Object.keys(CATEGORY_SEED_DESCRIPTIONS)[0];
+    await db.run(UPDATE(Categories).set({ seedDescription: edited }).where({ slug: target }));
+
+    const res = await seedCategoryDescriptions(db);
+    expect(res.updated).toBe(0); // nothing empty → nothing changed
+
+    const row = await db.run(
+      SELECT.one.from(Categories).columns('seedDescription').where({ slug: target }),
+    );
+    expect(row.seedDescription).toBe(edited); // untouched
+  });
+
+  it('re-seeds a description that was cleared back to empty (self-heals)', async () => {
+    const target = Object.keys(CATEGORY_SEED_DESCRIPTIONS)[1];
+    await db.run(UPDATE(Categories).set({ seedDescription: '' }).where({ slug: target }));
+
+    const res = await seedCategoryDescriptions(db);
+    expect(res.updated).toBe(1);
+
+    const row = await db.run(
+      SELECT.one.from(Categories).columns('seedDescription').where({ slug: target }),
+    );
+    expect(row.seedDescription).toBe(CATEGORY_SEED_DESCRIPTIONS[target]);
+  });
+});
diff --git a/test/unit/topic-detail-render.test.js b/test/unit/topic-detail-render.test.js
new file mode 100644
index 000000000..091c30f72
--- /dev/null
+++ b/test/unit/topic-detail-render.test.js
@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest';
+import { renderTopicDetail } from '../../srv/lib/topic-detail-render.js';
+
+describe('renderTopicDetail', () => {
+  const topic = {
+    slug: 'sap-hana-cloud', label: 'SAP HANA Cloud', facet: 'software-product',
+    tutorials: [{ slug: 'hana-intro', title: 'HANA Intro', level: 'Beginner', time: 15, href: '/tutorials/hana-intro/', isNew: true }],
+    concepts: [{ slug: 'in-memory-database', name: 'In-Memory Database', rank: 0.9 }],
+    relatedTags: [{ slug: 'sap-hana-cloud-data-lake', label: 'Data Lake' }],
+  };
+  it('renders a <main> body with breadcrumb, tutorials, concepts, related tags', () => {
+    const { body, contentHash } = renderTopicDetail(topic);
+    expect(body.startsWith('<main>')).toBe(true);
+    expect(body.endsWith('</main>')).toBe(true);
+    expect(body).toContain('SAP HANA Cloud');
+    expect(body).toContain('href="/tutorials/hana-intro/"');
+    expect(body).toContain('href="/concepts/in-memory-database/"');
+    expect(body).toContain('href="/topics/sap-hana-cloud-data-lake/"');
+    expect(contentHash).toMatch(/^[a-f0-9]{64}$/);
+  });
+  it('throws when slug or label missing', () => {
+    expect(() => renderTopicDetail({ slug: '', label: 'x' })).toThrow();
+  });
+});
diff --git a/test/unit/topic-list-page.test.js b/test/unit/topic-list-page.test.js
new file mode 100644
index 000000000..ba066d6d6
--- /dev/null
+++ b/test/unit/topic-list-page.test.js
@@ -0,0 +1,32 @@
+// test/unit/topic-list-page.test.js
+import { describe, it, expect } from 'vitest';
+import { renderTopicListBody } from '../../srv/lib/topic-list-page.js';
+
+describe('renderTopicListBody', () => {
+  const model = {
+    version: 'v1',
+    tree: [{
+      facet: 'software-product', label: 'Software Product',
+      children: [
+        { segment: 'sap-hana-cloud', slug: 'sap-hana-cloud', label: 'SAP HANA Cloud', tutorialCount: 3, conceptCount: 5, children: [
+          { segment: 'data-lake', slug: 'sap-hana-cloud-data-lake', label: 'Data Lake', tutorialCount: 1, conceptCount: 2, children: [] },
+        ] },
+      ],
+    }],
+  };
+  it('renders nested details/ul with topic links and no-JS disclosure', () => {
+    const html = renderTopicListBody(model);
+    expect(html).toContain('<details');
+    expect(html).toContain('<summary');
+    expect(html).toContain('href="/topics/sap-hana-cloud/"');
+    expect(html).toContain('href="/topics/sap-hana-cloud-data-lake/"');
+    expect(html).toContain('id="topics-tree-root"');
+  });
+  it('embeds the tree JSON and the island script', () => {
+    const html = renderTopicListBody(model);
+    expect(html).toContain('id="topics-tree-data"');
+    expect(html).toMatch(/<script type="module" src="[^"]+" defer>/);
+    // JSON must be HTML-safe
+    expect(html).not.toContain('</script></script>');
+  });
+});
diff --git a/test/unit/topic-slug.test.js b/test/unit/topic-slug.test.js
new file mode 100644
index 000000000..0ea4e51ff
--- /dev/null
+++ b/test/unit/topic-slug.test.js
@@ -0,0 +1,111 @@
+import { describe, it, expect } from 'vitest';
+import {
+  slugifyTopic, flattenTopicSlug, parseTitlePath, buildTopicSlugMap, normalizeLegacyTopicSlug,
+} from '../../srv/lib/topic-slug.js';
+
+// serveHandler gates every slug through this (content-store.js). A slug that
+// fails it 404s — the #2099 defect that made all 152 topic detail pages
+// un-servable. Every generated slug MUST satisfy it.
+const VALID_SLUG = /^[a-z0-9][a-z0-9-]*$/;
+
+describe('slugifyTopic', () => {
+  it('folds spaces, colons and slashes to single hyphens (real titlePath shape)', () => {
+    const s = slugifyTopic('software product : technology platform / sap business technology platform / open connectors');
+    expect(s).toBe('software-product-technology-platform-sap-business-technology-platform-open-connectors');
+    expect(VALID_SLUG.test(s)).toBe(true);
+  });
+  it('trims leading/trailing separators and collapses runs', () => {
+    expect(slugifyTopic('  : Topic : ')).toBe('topic');
+    expect(slugifyTopic('a---b   c')).toBe('a-b-c');
+  });
+});
+
+describe('flattenTopicSlug', () => {
+  it('collapses -- and lowercases', () => {
+    expect(flattenTopicSlug('sap-hana-cloud--data-lake')).toBe('sap-hana-cloud-data-lake');
+    expect(flattenTopicSlug('SAP-HANA-Cloud')).toBe('sap-hana-cloud');
+  });
+  it('produces a VALID_SLUG-safe result from spaces/colons/slashes', () => {
+    const s = flattenTopicSlug('topic : technology development / cloud operations');
+    expect(s).toBe('topic-technology-development-cloud-operations');
+    expect(VALID_SLUG.test(s)).toBe(true);
+  });
+});
+
+describe('parseTitlePath', () => {
+  it('splits facet on " : " and levels on " / " (real titlePath shape)', () => {
+    expect(parseTitlePath('Software Product : Enterprise Management / SAP S 4HANA')).toEqual({
+      facet: 'Software Product',
+      value: 'Enterprise Management / SAP S 4HANA',
+      segments: ['Enterprise Management', 'SAP S 4HANA'],
+    });
+  });
+  it('single-level value yields one segment', () => {
+    expect(parseTitlePath('Operating System : Android')).toEqual({
+      facet: 'Operating System',
+      value: 'Android',
+      segments: ['Android'],
+    });
+  });
+  it('facetless titlePath yields empty facet and the whole string as value', () => {
+    expect(parseTitlePath('Just A Topic')).toEqual({
+      facet: '',
+      value: 'Just A Topic',
+      segments: ['Just A Topic'],
+    });
+  });
+});
+
+describe('buildTopicSlugMap', () => {
+  it('derives the slug from the FULL titlePath and parses facet/segments', () => {
+    const { bySlug } = buildTopicSlugMap([
+      { titlePath: 'Operating System : Android', label: null, tutorialCount: 5, conceptCount: 2 },
+    ]);
+    expect(bySlug.has('operating-system-android')).toBe(true);
+    const t = bySlug.get('operating-system-android');
+    expect(t.facet).toBe('Operating System');
+    expect(t.segments).toEqual(['Android']);
+    expect(t.label).toBe('Android'); // last segment when no curated label
+    expect(VALID_SLUG.test(t.slug)).toBe(true);
+  });
+
+  it('parses a multi-level hierarchy into segments while keeping the full-path slug', () => {
+    const { bySlug } = buildTopicSlugMap([
+      { titlePath: 'Software Product : Enterprise Management / SAP S 4HANA' },
+    ]);
+    const t = bySlug.get('software-product-enterprise-management-sap-s-4hana');
+    expect(t).toBeTruthy();
+    expect(t.facet).toBe('Software Product');
+    expect(t.segments).toEqual(['Enterprise Management', 'SAP S 4HANA']);
+    expect(t.label).toBe('SAP S 4HANA');
+  });
+
+  it('index-suffixes a rare full-path slug collision (no leading hyphen)', () => {
+    const { bySlug } = buildTopicSlugMap([
+      { titlePath: 'Foo : Bar', label: 'A' },
+      { titlePath: 'Foo / Bar', label: 'B' }, // slugifies to the same "foo-bar"
+    ]);
+    for (const s of bySlug.keys()) expect(VALID_SLUG.test(s)).toBe(true);
+    expect(bySlug.has('foo-bar')).toBe(true);
+    expect(bySlug.has('foo-bar-2')).toBe(true); // index-suffixed, not "-foo-bar"
+  });
+
+  it('every slug from real-world titlePaths (spaces/colons/slashes) is VALID_SLUG-safe', () => {
+    const { bySlug } = buildTopicSlugMap([
+      { titlePath: 'software product : technology platform / sap business technology platform / open connectors', label: 'X' },
+      { titlePath: 'topic : technology development / cloud operations', label: 'Y' },
+      { titlePath: 'operating system : android', label: 'Z' },
+    ]);
+    const slugs = [...bySlug.keys()];
+    expect(slugs).toHaveLength(3);
+    for (const s of slugs) expect(VALID_SLUG.test(s)).toBe(true);
+  });
+});
+
+describe('normalizeLegacyTopicSlug', () => {
+  it('strips a trailing numeric disambiguator', () => {
+    expect(normalizeLegacyTopicSlug('sap-hana-smart-data-streaming-development-2'))
+      .toBe('sap-hana-smart-data-streaming-development');
+    expect(normalizeLegacyTopicSlug('sap-hana-cloud')).toBe('sap-hana-cloud');
+  });
+});
diff --git a/test/unit/topics-query.test.js b/test/unit/topics-query.test.js
new file mode 100644
index 000000000..26edb493a
--- /dev/null
+++ b/test/unit/topics-query.test.js
@@ -0,0 +1,85 @@
+// test/unit/topics-query.test.js
+import { describe, it, beforeAll, expect } from 'vitest';
+import cds from '@sap/cds';
+import {
+  loadLiveTags, buildTopicsTreePayload, resolveTopicBySlug, buildTopicDetailPayload,
+} from '../../srv/lib/topics-query.js';
+
+const NS = 'com.sap.developers.ims';
+
+cds.test('serve', '--project', '.', '--in-memory');
+
+describe('topics-query', () => {
+  let db;
+  beforeAll(async () => {
+    db = await cds.connect.to('db');
+    const { Tutorials, Tags, TutorialTags, TutorialConceptLinks, Concepts } = cds.entities(NS);
+    await db.run(INSERT.into(Tags).entries([
+      // Real titlePath shape: facet split by " : ", hierarchy levels by " / ".
+      { ID: 't1', titlePath: 'Software Product : SAP HANA Cloud', label: 'SAP HANA Cloud', name: 'sap-hana-cloud' },
+      { ID: 't2', titlePath: 'Software Product : Database / SAP HANA Cloud / Data Lake', label: 'Data Lake', name: 'sap-hana-cloud-data-lake' },
+    ]));
+    await db.run(INSERT.into(Tutorials).entries([
+      { ID: 'tut1', slug: 'hana-intro', title: 'HANA Intro', experienceTag: 'Beginner' },
+      { ID: 'tut2', slug: 'data-lake-intro', title: 'Data Lake Intro', experienceTag: 'Beginner' },
+    ]));
+    await db.run(INSERT.into(TutorialTags).entries([
+      { tutorial_ID: 'tut1', tag_ID: 't1' },
+      { tutorial_ID: 'tut2', tag_ID: 't2' },
+    ]));
+    await db.run(INSERT.into(Concepts).entries([
+      { ID: 'c1', slug: 'in-memory-database', name: 'In-Memory Database', status: 'ACTIVE', publishedAt: new Date().toISOString() },
+    ]));
+    await db.run(INSERT.into(TutorialConceptLinks).entries([
+      { ID: 'l1', tutorial_ID: 'tut1', concept_ID: 'c1', predicate: 'teaches' },
+    ]));
+  });
+
+  it('loadLiveTags returns only tags with ≥1 tutorial, with counts', async () => {
+    const live = await loadLiveTags(db);
+    const slugs = live.map(t => t.slug).sort();
+    expect(slugs).toContain('software-product-sap-hana-cloud');
+    const hana = live.find(t => t.slug === 'software-product-sap-hana-cloud');
+    expect(hana.tutorialCount).toBe(1);
+    expect(hana.conceptCount).toBe(1);
+    expect(hana.facet).toBe('Software Product');
+    expect(hana.segments).toEqual(['SAP HANA Cloud']);
+  });
+
+  it('buildTopicsTreePayload nests facet → hierarchy folders → leaf', async () => {
+    const { tree, error } = await buildTopicsTreePayload(db);
+    expect(error).toBeFalsy();
+    const facet = tree.find(f => f.facet === 'Software Product');
+    expect(facet).toBeTruthy();
+    // single-level tag is a direct leaf under the facet
+    expect(facet.children.some(n => n.slug === 'software-product-sap-hana-cloud')).toBe(true);
+    // multi-level tag: Database (folder) → SAP HANA Cloud (folder) → Data Lake (leaf)
+    const database = facet.children.find(n => n.label === 'Database' || n.name === 'Database');
+    expect(database).toBeTruthy();
+    expect(database.children?.length).toBeGreaterThan(0);
+    const mid = database.children.find(n => (n.label || n.name) === 'SAP HANA Cloud');
+    expect(mid).toBeTruthy();
+    const leaf = mid.children.find(n => n.slug === 'software-product-database-sap-hana-cloud-data-lake');
+    expect(leaf).toBeTruthy();
+    expect(leaf.tutorialCount).toBe(1);
+  });
+
+  it('buildTopicDetailPayload returns tutorials + concepts', async () => {
+    const p = await buildTopicDetailPayload(db, 'software-product-sap-hana-cloud');
+    expect(p.notFound).toBeFalsy();
+    expect(p.tutorials.map(t => t.slug)).toContain('hana-intro');
+    expect(p.concepts.map(c => c.slug)).toContain('in-memory-database');
+  });
+
+  it('resolveTopicBySlug strips legacy -N and redirects', async () => {
+    const r = await resolveTopicBySlug(db, 'software-product-sap-hana-cloud-2');
+    expect(r.tag?.slug).toBe('software-product-sap-hana-cloud');
+    expect(r.redirectTo).toBe('/topics/software-product-sap-hana-cloud/');
+  });
+
+  it('unknown slug is notFound with redirect to /topics/', async () => {
+    const p = await buildTopicDetailPayload(db, 'does-not-exist');
+    expect(p.notFound).toBe(true);
+    expect(p.redirectTo).toBe('/topics/');
+  });
+});
diff --git a/test/unit/validation-rules-publish.test.js b/test/unit/validation-rules-publish.test.js
new file mode 100644
index 000000000..d3016ae54
--- /dev/null
+++ b/test/unit/validation-rules-publish.test.js
@@ -0,0 +1,28 @@
+// test/unit/validation-rules-publish.test.js
+import { describe, it, expect, beforeAll } from 'vitest'
+import path from 'node:path'
+import cds from '@sap/cds'
+import { replaceValidationRulesForSlug } from '../../srv/lib/validation-rules-publish.js'
+
+describe('replaceValidationRulesForSlug', () => {
+  let db
+  beforeAll(async () => {
+    await cds.deploy(path.join(process.cwd(), 'db', 'schema.cds')).to('sqlite::memory:')
+    db = cds.db
+  })
+
+  it('replaces all-rule rows for a slug', async () => {
+    const { Tutorials, TutorialValidationRules } = cds.entities('com.sap.developers.ims')
+    const ID = cds.utils.uuid()
+    await db.run(INSERT.into(Tutorials).entries({ ID, slug: 'vr-demo', title: 'VR' }))
+    await replaceValidationRulesForSlug(db, 'VR-DEMO', [
+      { stepNumber: 1, questionId: 'validate-1', questionText: 'Q', ruleType: 'single-choice', questionType: 'MCQ', choiceMode: 'single', options: '["A","B"]', correctAnswer: 'A', aiGrading: false },
+    ])
+    let rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(1)
+    expect(rows[0].aiGrading).toBe(false)
+    await replaceValidationRulesForSlug(db, 'vr-demo', [])
+    rows = await db.run(SELECT.from(TutorialValidationRules).where({ tutorial_ID: ID }))
+    expect(rows).toHaveLength(0)
+  })
+})