chore(release): 2.2.0

test: cover auth token, cookie and expiry boundaries (WealthLedger/backend#61) (#113 )
chore: adopt linear git model in backend docs (#111 )
2026-10-18 16:25:22 +03:00 · 2026-10-18 15:55:05 +03:00 · 2026-10-17 14:19:19 +03:00 · 2026-10-16 23:23:12 +03:00 · 2026-10-16 10:00:47 +03:00 · 2026-10-16 07:38:58 +03:00
49 changed files with 1268 additions and 944 deletions
@@ -89,4 +89,9 @@ Commits и PR titles — Conventional Commits с parser-recognized Issue referen
 `spec:`. Каждый commit содержит одну задачу. Исключения release и правила
 ссылки — в Engineering Workflow из AGENTS. Root другого checkout не управляет этим repo.
 Прямой push в `main`, force-push и перенос опубликованных тегов не входят в
-обычную работу. Перед release/hotfix прочитай местный README, раздел «Релизы».
+обычную работу. PR сливается squash или rebase-merge; merge-коммит не
+используется. `main` обновляется только fast-forward из `develop`, поэтому
+`origin/main` всегда предок `origin/develop`:
+`git merge-base --is-ancestor origin/main origin/develop`. Срочный fix —
+обычная ветка `fix/*` от `develop`; пути hotfix от `main` нет.
+Перед релизом прочитай местный README, раздел «Релизы».
@@ -28,9 +28,8 @@ jobs:
          docker version
          docker buildx version
      - run: npm ci
-      - run: npx --no-install prisma generate
      - run: npm run verify
-      - run: npm run test:e2e
+      - run: node test/sqlite.cjs --all
      - name: Login with dedicated Nexus writer
        env:
          REGISTRY_USERNAME: ${{ secrets.NEXUS_USERNAME }}
@@ -4,7 +4,7 @@ on:
  push:
    branches: [develop, main]
  pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, edited]
  schedule:
    - cron: '47 5 * * *'

@@ -34,12 +34,17 @@ jobs:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
-          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
+          if [[ "$PR_TITLE" =~ ^chore\(release\):\ [0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            npm run commitlint -- --strict --from "$HEAD_SHA^" --to "$HEAD_SHA"
+          else
+            npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
+          fi

  security:
    needs: commits
    if: >-
      !cancelled() &&
+      gitea.event.action != 'edited' &&
      (needs.commits.result == 'success' || needs.commits.result == 'skipped')
    timeout-minutes: 15
    runs-on: ubuntu-latest
@@ -67,7 +72,8 @@ jobs:
  verify:
    needs: [commits, security]
    if: >-
-      !cancelled() && needs.security.result == 'success' &&
+      !cancelled() && gitea.event.action != 'edited' &&
+      needs.security.result == 'success' &&
      gitea.event_name != 'schedule'
    timeout-minutes: 45
    runs-on: ubuntu-latest
@@ -81,12 +87,10 @@ jobs:
        with:
          node-version-file: .nvmrc
      - run: npm ci
-      - name: Generate Prisma client before typechecks
-        run: npx --no-install prisma generate
      - name: Run all backend gates
        run: npm run verify
      - name: Run isolated SQLite and runtime OpenAPI suites
-        run: npm run test:e2e
+        run: node test/sqlite.cjs --all
      - name: Analyze develop with SonarQube
        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/develop'
        # v2.3.0: same Docker-based scanner used for SonarQube 9.9.
@@ -1,5 +1,89 @@
 # Changelog

+## [2.2.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v2.1.0...v2.2.0) (2026-10-18)
+
+### Features
+
+* unify income payment cards and drop period comparisons (WealthLedger/main[#33](https://git.personal.ksv741.ru/WealthLedger/backend/issues/33)) ([#83](https://git.personal.ksv741.ru/WealthLedger/backend/issues/83)) ([31b0e15](https://git.personal.ksv741.ru/WealthLedger/backend/commit/31b0e1557978019a9293e5fd3efeee319194cddd))
+
+### Bug Fixes
+
+* align password policy to 8-72 printable ASCII on register (WealthLedger/backend[#60](https://git.personal.ksv741.ru/WealthLedger/backend/issues/60)) ([#109](https://git.personal.ksv741.ru/WealthLedger/backend/issues/109)) ([e03fad6](https://git.personal.ksv741.ru/WealthLedger/backend/commit/e03fad622bfec0fa7e42d536f65e361d319a1ac9))
+* restore screener OpenAPI constraints (WealthLedger/backend[#70](https://git.personal.ksv741.ru/WealthLedger/backend/issues/70)) ([#95](https://git.personal.ksv741.ru/WealthLedger/backend/issues/95)) ([2ad3517](https://git.personal.ksv741.ru/WealthLedger/backend/commit/2ad3517d87bffa8af9285d72fd6f78b96b3eed9f))
+* separate T-Bank RPC network time from queue wait (WealthLedger/backend[#81](https://git.personal.ksv741.ru/WealthLedger/backend/issues/81)) ([#94](https://git.personal.ksv741.ru/WealthLedger/backend/issues/94)) ([0d7839c](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0d7839cf79669768bba55f420ed43304545ac8d9))
+* skip hourly terms overlapped by a long walk (WealthLedger/backend[#54](https://git.personal.ksv741.ru/WealthLedger/backend/issues/54)) ([6975853](https://git.personal.ksv741.ru/WealthLedger/backend/commit/6975853656698b61781ca056f35c0d68e47ea32a))
+* surface durable hourly attempt in accounts and income meta (WealthLedger/backend[#58](https://git.personal.ksv741.ru/WealthLedger/backend/issues/58)) ([14bcb9d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/14bcb9da5ff081710d672d140175d348a03a2fe5))
+* translate permanent invalid-token errors on online entrypoints (WealthLedger/backend[#59](https://git.personal.ksv741.ru/WealthLedger/backend/issues/59)) ([#110](https://git.personal.ksv741.ru/WealthLedger/backend/issues/110)) ([8a6f60d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/8a6f60d9651fc7c474dd9b3690314505e18c4fa0))
+
+### Performance
+
+* batch bank operation page relations (WealthLedger/backend[#68](https://git.personal.ksv741.ru/WealthLedger/backend/issues/68)) ([285dd08](https://git.personal.ksv741.ru/WealthLedger/backend/commit/285dd08472d9acb66fab8d46d511d9ce607b110f))
+* start bond search prices with details (WealthLedger/backend[#71](https://git.personal.ksv741.ru/WealthLedger/backend/issues/71)) ([#89](https://git.personal.ksv741.ru/WealthLedger/backend/issues/89)) ([da2e1d0](https://git.personal.ksv741.ru/WealthLedger/backend/commit/da2e1d0781d23f4ab1c38e7bf3cad2e254d026d5))
+
+### Refactoring
+
+* extract shared public instrument projection ([#69](https://git.personal.ksv741.ru/WealthLedger/backend/issues/69)) ([#84](https://git.personal.ksv741.ru/WealthLedger/backend/issues/84)) ([9b7e5e1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/9b7e5e1215b7c1c5320effb6ba5b2c2a8b0cd604))
+* remove unreachable catalog producer and sync orchestration (WealthLedger/backend[#62](https://git.personal.ksv741.ru/WealthLedger/backend/issues/62)) ([#98](https://git.personal.ksv741.ru/WealthLedger/backend/issues/98)) ([96d4de4](https://git.personal.ksv741.ru/WealthLedger/backend/commit/96d4de4195b105d64ac6ffaf8d3d8aab4142ece4))
+
+### CI
+
+* validate edited PR titles (WealthLedger/backend[#74](https://git.personal.ksv741.ru/WealthLedger/backend/issues/74)) ([bbb5aff](https://git.personal.ksv741.ru/WealthLedger/backend/commit/bbb5afff842720374feecfcd74eea83283e0b2ae))
+
+### Tests
+
+* await portfolio publication done instead of polling ticks (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#103](https://git.personal.ksv741.ru/WealthLedger/backend/issues/103)) ([7023021](https://git.personal.ksv741.ru/WealthLedger/backend/commit/702302126b81335959be2e66b4b5ad38e5806b70))
+* cover auth token, cookie and expiry boundaries (WealthLedger/backend[#61](https://git.personal.ksv741.ru/WealthLedger/backend/issues/61)) ([#113](https://git.personal.ksv741.ru/WealthLedger/backend/issues/113)) ([32622c1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/32622c1dad9649842d8cb78d8e964da33e5df459))
+* isolate HTTP suites from scheduler and bank-card case order (WealthLedger/backend[#65](https://git.personal.ksv741.ru/WealthLedger/backend/issues/65)) ([#100](https://git.personal.ksv741.ru/WealthLedger/backend/issues/100)) ([9e4f9d9](https://git.personal.ksv741.ru/WealthLedger/backend/commit/9e4f9d9cab12aa714449b99280894a521c3514b6))
+* replace late portfolio sleep with started and done barriers (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#101](https://git.personal.ksv741.ru/WealthLedger/backend/issues/101)) ([7bc7d8d](https://git.personal.ksv741.ru/WealthLedger/backend/commit/7bc7d8ddecc6cb9f387d00be68f61eb99d57d6fc))
+* replace metadata sleeps with upstream start barriers (WealthLedger/backend[#63](https://git.personal.ksv741.ru/WealthLedger/backend/issues/63)) ([#102](https://git.personal.ksv741.ru/WealthLedger/backend/issues/102)) ([ec6d9a2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/ec6d9a2639f1845674bf7ce5fc357f2f7b7f5dfb))
+* slim sqlite runner regression workload (WealthLedger/backend[#72](https://git.personal.ksv741.ru/WealthLedger/backend/issues/72)) ([1033d21](https://git.personal.ksv741.ru/WealthLedger/backend/commit/1033d2114e99232a90c5d5c321749a9c6e3fbff0))
+
+### Maintenance
+
+* adopt linear git model in backend docs ([#111](https://git.personal.ksv741.ru/WealthLedger/backend/issues/111)) ([4f485ab](https://git.personal.ksv741.ru/WealthLedger/backend/commit/4f485ab0e9f0f9d52ae446e51966525473948b0e))
+* align SQLite driver version (WealthLedger/backend[#67](https://git.personal.ksv741.ru/WealthLedger/backend/issues/67)) ([203cc72](https://git.personal.ksv741.ru/WealthLedger/backend/commit/203cc72cb2d1aac34f39c5ba528820b511666f17))
+* drop unused direct source-map-support dependency (WealthLedger/backend[#4](https://git.personal.ksv741.ru/WealthLedger/backend/issues/4)) ([#96](https://git.personal.ksv741.ru/WealthLedger/backend/issues/96)) ([c789e33](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c789e33c41281f2fc3de8851f21ae897a81e2b5d))
+* make OpenAPI export atomic and add read-only check (WealthLedger/backend[#3](https://git.personal.ksv741.ru/WealthLedger/backend/issues/3)) ([#97](https://git.personal.ksv741.ru/WealthLedger/backend/issues/97)) ([a93f2d5](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a93f2d55e7a31515ed1cc056cd57101f2b315405))
+* unify verification preparation (WealthLedger/backend[#66](https://git.personal.ksv741.ru/WealthLedger/backend/issues/66)) ([b90cedd](https://git.personal.ksv741.ru/WealthLedger/backend/commit/b90cedd580321fb560a4ad0d9f9f5ba03303248e))
+
+## [2.1.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v2.0.0...v2.1.0) (2026-10-12)
+
+### Features
+
+* add hourly portfolio sync history ([0057925](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0057925888dde874830149865fc5e13920ac5783))
+* add stock screener ([7d10ef8](https://git.personal.ksv741.ru/WealthLedger/backend/commit/7d10ef8adfce76ad2ed6368e1022fbd3f6847a23))
+* reconcile hourly investment resource states ([323b83b](https://git.personal.ksv741.ru/WealthLedger/backend/commit/323b83b5827d1191fbc14cfdf1d0e62f249fc78d))
+
+### Bug Fixes
+
+* align backend workflow rules (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([c7d0600](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c7d060023b612af9e1dd4c2a2fb2d5d1bf173784))
+* bound hourly step awaits by the per-step wait limit ([#56](https://git.personal.ksv741.ru/WealthLedger/backend/issues/56)) ([52fa3a3](https://git.personal.ksv741.ru/WealthLedger/backend/commit/52fa3a36baa5ab236a7ebd64ef1b4f447c91e129))
+* keep candle retries read-only ([947ffef](https://git.personal.ksv741.ru/WealthLedger/backend/commit/947ffefa9b8cad7f19355c187f2bd50c9739a822))
+* restore terminal hourly lifecycle after persistence failure ([#56](https://git.personal.ksv741.ru/WealthLedger/backend/issues/56)) ([fa57a20](https://git.personal.ksv741.ru/WealthLedger/backend/commit/fa57a201fdd8127774aee9af553da75a75add07c))
+* unblock backend dependency audit ([85858a1](https://git.personal.ksv741.ru/WealthLedger/backend/commit/85858a160f00dd428c80b8fa1824c1779245fdfe))
+
+### Documentation
+
+* clarify backend verification policy ([d7895f2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/d7895f287ee802e7b13df7a2a4c6dba0b711e5a9))
+* pin backend workflow reference (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([c5248db](https://git.personal.ksv741.ru/WealthLedger/backend/commit/c5248dbefc4b11a9f417bc835041a4294bd61047))
+
+### CI
+
+* skip checks on PR metadata edits ([0ad84ff](https://git.personal.ksv741.ru/WealthLedger/backend/commit/0ad84ff4f0b4712abc7e69dc299856f14af6eadd))
+
+### Tests
+
+* align all accounts metadata ([db375cb](https://git.personal.ksv741.ru/WealthLedger/backend/commit/db375cbee7d8f1eff48822b8e3c74898f40e8886))
+* align resource availability metadata ([bc631e7](https://git.personal.ksv741.ru/WealthLedger/backend/commit/bc631e72de0d9b0ff7b261b1ea644a73c2943d2a))
+* align upcoming events with local reads ([966b2a5](https://git.personal.ksv741.ru/WealthLedger/backend/commit/966b2a5836cdaf5b761e3c76568ff30a90ba1f4c))
+* extend ledger sqlite timeout ([4870d49](https://git.personal.ksv741.ru/WealthLedger/backend/commit/4870d4950303ad1de743e19b665b2fbdc05b781a))
+* increase ledger request timeout ([2facd86](https://git.personal.ksv741.ru/WealthLedger/backend/commit/2facd8675c74a97d92e0e8f44ed4a93aabb47674))
+
+### Maintenance
+
+* align backend engineering workflow (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/backend/issues/27)) ([a31e8d2](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a31e8d2c4d85a21cdd5efdcc9f5fe503f210804b))
+* prune obsolete eslint suppressions ([a46a411](https://git.personal.ksv741.ru/WealthLedger/backend/commit/a46a4112cbcc72b1c3ff17cac4ac8bebcf579bca))
+
 ## [2.0.0](https://git.personal.ksv741.ru/WealthLedger/backend/compare/v1.0.0...v2.0.0) (2026-10-07)

 ### ⚠ BREAKING CHANGES
@@ -19,7 +19,8 @@ EXPOSE 3000
 CMD ["npm", "run", "start:dev"]

 FROM dependencies AS build
-RUN npm run build && npm prune --omit=dev --omit=optional
+# The client is already generated at the shared dependencies stage (same revision).
+RUN npx --no-install nest build && npm prune --omit=dev --omit=optional

 FROM base AS production
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates=20250419~deb12u1 openssl=3.0.20-1~deb12u2 && rm -rf /var/lib/apt/lists/* \
@@ -14,6 +14,7 @@ cp .env.example .env
 nvm use --silent
 npm ci
 npx prisma migrate deploy
+npx prisma generate
 npm run start:dev
 ```

@@ -60,7 +61,7 @@ Compose topology принадлежит workspace, эксплуатационн
 npm run verify
 ```

-Он запускает zero-warning lint,
+Он запускает генерацию Prisma client, zero-warning lint,
 application/test typechecks, Jest с покрытием и build. `npm run lint:fix` — отдельная
 записывающая команда. `npm run test:cov` также доступен отдельно; общего числового
 threshold нет. `npm run test:e2e` отдельно проверяет функциональные HTTP suites
@@ -80,11 +81,13 @@ TypeScript 7 требует поддержки со стороны `ts-jest` и
 Единый `.gitea/workflows/verify.yml` запускает `commits → security → verify`
 последовательно на PR; на push в `develop`/`main` — `security → verify`.
 Рабочие ветки проверяются после открытия PR, без дублирующего push-запуска.
-Изменение заголовка PR тоже повторяет проверки Conventional Commits.
+Изменение заголовка PR повторяет только проверку Conventional Commits; `security`
+и `verify` на metadata-only событии не запускаются.
 Новый запуск отменяет устаревший для того же PR/ветки и типа события
 (требуется Gitea 1.26+). Ежедневно в 05:47 UTC выполняется только `security`.
-Job `verify` запускает `npm ci`, генерацию Prisma client,
-`npm run verify` и функциональный `npm run test:e2e`. Используется только checkout
+Job `verify` запускает `npm ci` и `npm run verify` (генерация Prisma client
+внутри gate, один Nest build), затем функциональный `node test/sqlite.cjs --all`
+на уже собранных артефактах. Используется только checkout
 backend и его зависимости; OpenAPI генерируется во время проверки, SHA записывается в лог.
 Успешный unit gate не заменяет SQLite/e2e; ошибка любой suite завершает job с FAIL.

@@ -215,7 +218,10 @@ nvm use --silent
 npm run openapi:generate
 ```

-Команда собирает backend и записывает `openapi.json` в корень репозитория.
+Команда собирает backend и записывает `openapi.json` в корень репозитория
+атомарно: через временный файл и rename, без частичной записи при сбое.
+`npm run openapi:check` только сравнивает runtime schema с файлом и завершается
+с ошибкой при расхождении, не перезаписывая его.
 Сервер и HTTP-порт не запускаются; Nest preview читает metadata без создания
 провайдеров и подключения к БД/T-Bank. Настроенный `.env` и реальные секреты
 не нужны. `openapi.json` исключён из Git и каждый раз создаётся из DTO/Swagger
@@ -248,10 +254,14 @@ breaking changes относительно предыдущего выпуска.
 настраивается отдельно. История migrations применяется штатным `migrate deploy`.

 Регрессия самого запуска: `node test/sqlite-regression.cjs`. Она выполняет
-три последовательных и два параллельных полных e2e, проверяет уникальность DB,
-сохранность вымышленного внешнего файла, отказ migration и SIGINT/SIGTERM cleanup.
+три последовательных и два параллельных запуска двух обычных e2e suites,
+проверяет уникальность DB, сохранность вымышленного внешнего файла, отказ migration
+и SIGINT/SIGTERM cleanup. Полный e2e набор остаётся в `npm run test:e2e`.
 Логи остаются в каталоге из вывода. Для одной suite:
-`node test/sqlite.cjs app.e2e-spec.ts`.
+`node test/sqlite.cjs app.e2e-spec.ts`. Crash-регрессия в
+`tbank-operations-sync.e2e-spec.ts` загружает классы из `dist/`, поэтому перед
+адресным запуском этой suite выполните `npm run build`, иначе child/dist может
+расходиться с parent/src.

 | Риск | Проверка реальной DB |
 | --- | --- |
@@ -297,35 +307,57 @@ Durability оставляет временные DB, логи и `result.json`
 Репозиторий выпускается независимо. `develop` — интеграция, `main` — принятые
 релизы. Обычная работа: issue-linked ветка от актуального `develop`, PR в `develop`;
 общие правила — в Engineering Workflow по ссылке из AGENTS.
-Обычные PR допускают squash; release и обратная синхронизация сохраняют историю.
+PR сливается squash или rebase-merge; merge-коммит не используется. `main`
+обновляется только fast-forward из `develop`, поэтому история линейна:
+
+```text
+<type>/<issue>-<slug> --squash--> develop --ff-only--> main --> tag vX.Y.Z
+```
+
+Инвариант: `origin/main` всегда предок `origin/develop`. Проверка:
+
+```bash
+git fetch -q origin
+git merge-base --is-ancestor origin/main origin/develop && echo ok || echo BROKEN
+```
+
 Commits и PR titles — Conventional Commits со ссылкой на Issue (кроме release),
 включая `spec:`. Версии вручную не повышай.

-1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Убедись, что
-   `develop` содержит последний релиз. Создай `release/<name>` от проверенного
-   `develop`; `nvm use --silent`, `npm ci`. Hotfix начинается от `main` в
-   `release/hotfix-<name>` и проходит тот же процесс.
+1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Проверь
+   инвариант. Создай `release/X.Y.Z` от проверенного `develop`;
+   `nvm use --silent`, `npm ci`.
 2. На чистой ветке выполни `npm run release:preview`, просмотри версию/changelog,
   затем `npm run release:prepare`. Команда создаёт `chore(release): X.Y.Z`,
   обновляет manifest/lockfile/CHANGELOG; тег и push не выполняет. Не обходи
   guards ветки, чистого дерева, отсутствующих тегов или уже подготовленной версии.
 3. Проверь diff и штатные gates этого репозитория. Отправь только release-ветку,
-   открой PR в `main` с заголовком `chore(release): X.Y.Z`. После зелёных
-   `verify`, `security`, `commits` выполни fast-forward-only merge. Если `main`
-   изменился, согласуй историю и повтори проверки кандидата.
-4. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
+   открой PR в **`develop`** с заголовком `chore(release): X.Y.Z`. После зелёных
+   `verify`, `security`, `commits` выполни fast-forward-only merge. Если
+   `develop` изменился, обнови release-ветку и повтори проверки кандидата.
+4. Открой PR `develop → main` с тем же заголовком и слей fast-forward-only.
+5. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
   manifest/lockfile. Создай аннотированный `vX.Y.Z` именно на этом SHA:
   `git tag -a vX.Y.Z <release-sha> -m "Release X.Y.Z"`, затем отправь только
   `git push origin refs/tags/vX.Y.Z`. Не запускай release-it повторно на `main`.
-5. Верни release-коммит через PR `main → develop` без squash/rebase; проверь,
-   что `develop` содержит тег. Опубликованные теги не перемещай. При сбое после
-   merge создай отсутствующий тег без нового bump; до merge исправь и проверь
-   существующий кандидат без повторного повышения версии.
+Обратная синхронизация не нужна: release-коммит попал в `develop` на шаге 3.
+Опубликованные теги не перемещай. При сбое после merge создай отсутствующий тег
+без нового bump; до merge исправь и проверь существующий кандидат без
+повторного повышения версии.
+
+Freeze релиза не поддерживается: пока открыт релизный PR, `develop` не двигают.
+Срочный fix — обычная ветка `fix/*` от `develop` с последующим релизом;
+пути от `main` нет, он сделал бы `main` не-предком `develop`. Исключение
+требует явного решения: `release/hotfix-<name>` от `main`, PR в `main`, тег,
+затем merge `main → develop` для восстановления инварианта.

 `feat:` повышает minor, `fix:`/`perf:` и прочие разрешённые типы — patch;
 `!`/`BREAKING CHANGE:` — major, включая версии до 1.0. `chore(release):`
 исключён из рекомендации и changelog. Конфигурация — `.release-it.json`.
 В Gitea для `main`/`develop` должны быть запрещены прямой/force push и обход
-администратором, обязательны `verify`, `security`, `commits`; теги `v*` защищены.
+администратором, включена блокировка устаревшей ветки, обязательны `verify`,
+`security`, `commits`; теги `v*` защищены. Линейность обеспечивают merge styles
+репозитория: merge-коммиты и rebase `--no-ff` выключены, доступны squash,
+rebase-merge и fast-forward-only; стиль по умолчанию — squash.
 Workflow сам не включает эти настройки. Отдельное review approval для одного
 владельца не требуется. Npm publishing, deploy и Gitea Releases не включены.
@@ -54,9 +54,6 @@
    }
  },
  "src/modules/investments/instruments/application/catalog-discovery.service.ts": {
-    "sonarjs/cognitive-complexity": {
-      "count": 1
-    },
    "sonarjs/no-nested-conditional": {
      "count": 1
    }
@@ -142,11 +139,8 @@
    }
  },
  "src/modules/investments/tbank-sync/tbank-sync.service.ts": {
-    "sonarjs/cognitive-complexity": {
-      "count": 1
-    },
    "sonarjs/no-nested-conditional": {
-      "count": 7
+      "count": 6
    }
  },
  "test/bank-cards-durability.cjs": {
@@ -1,12 +1,12 @@
 {
  "name": "wealth-ledger-backend",
-  "version": "2.0.0",
+  "version": "2.2.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "wealth-ledger-backend",
-      "version": "2.0.0",
+      "version": "2.2.0",
      "license": "UNLICENSED",
      "dependencies": {
        "@grpc/grpc-js": "1.14.5",
@@ -66,7 +66,6 @@
        "globals": "17.12.0",
        "jest": "30.5.1",
        "release-it": "21.0.2",
-        "source-map-support": "0.5.21",
        "supertest": "7.2.2",
        "ts-jest": "29.4.12",
        "ts-loader": "9.6.2",
@@ -13624,6 +13623,7 @@
      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
      "dev": true,
      "license": "MIT",
+      "peer": true,
      "dependencies": {
        "buffer-from": "^1.0.0",
        "source-map": "^0.6.0"
@@ -13635,6 +13635,7 @@
      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
      "dev": true,
      "license": "BSD-3-Clause",
+      "peer": true,
      "engines": {
        "node": ">=0.10.0"
      }
@@ -1,6 +1,6 @@
 {
  "name": "wealth-ledger-backend",
-  "version": "2.0.0",
+  "version": "2.2.0",
  "description": "",
  "author": "",
  "private": true,
@@ -11,10 +11,11 @@
  "scripts": {
    "build": "prisma generate && nest build",
    "openapi:generate": "npm run build && node scripts/generate-openapi.cjs",
+    "openapi:check": "npm run build && node scripts/generate-openapi.cjs --check",
    "format": "npm run lint:fix",
    "start": "nest start",
    "start:dev": "NODE_ENV=development nest start --watch --path tsconfig.dev.json",
-    "start:debug": "nest start --debug --watch --path tsconfig.dev.json",
+    "start:debug": "NODE_ENV=development nest start --debug --watch --path tsconfig.dev.json",
    "start:prod": "node dist/src/main.js",
    "lint": "npm run lint:check",
    "lint:check": "eslint . --max-warnings=0",
@@ -31,7 +32,7 @@
    "test:container": "node test/container-smoke.cjs",
    "test:durability": "node test/bank-cards-durability.cjs",
    "test:openapi-contract": "npm run build && node test/sqlite.cjs openapi-contract.e2e-spec.ts",
-    "verify": "npm run lint && npm run test:lint && npm run typecheck:app && npm run typecheck:test && npm run test:cov -- --runInBand && npm run build",
+    "verify": "prisma generate && npm run lint && npm run test:lint && npm run typecheck:app && npm run typecheck:test && npm run test:cov -- --runInBand && nest build",
    "release:preview": "release-it --dry-run --ci",
    "release:prepare": "release-it --ci",
    "commitlint": "commitlint",
@@ -95,7 +96,6 @@
    "globals": "17.12.0",
    "jest": "30.5.1",
    "release-it": "21.0.2",
-    "source-map-support": "0.5.21",
    "supertest": "7.2.2",
    "ts-jest": "29.4.12",
    "ts-loader": "9.6.2",
@@ -1,5 +1,10 @@
 const { randomBytes } = require('node:crypto');
-const { writeFile } = require('node:fs/promises');
+const { readFile, rename, rm, writeFile } = require('node:fs/promises');
+const { resolve } = require('node:path');
+
+// Relative to the working directory, as before: the contract test runs the script in a temporary directory.
+const target = resolve(process.cwd(), 'openapi.json');
+const checkOnly = process.argv.includes('--check');

 // Schema generation needs no deployment configuration or real credentials.
 Object.assign(process.env, {
@@ -19,23 +24,48 @@ const { NestFactory } = require('@nestjs/core');
 const { AppModule } = require('../dist/src/app.module.js');
 const { API_PREFIX, createOpenApiDocument } = require('../dist/src/openapi.js');

-async function generate() {
+async function render() {
  const app = await NestFactory.create(AppModule, {
    preview: true,
    logger: false,
  });
  try {
    app.setGlobalPrefix(API_PREFIX);
-    await writeFile(
-      'openapi.json',
-      JSON.stringify(createOpenApiDocument(app), null, 2) + '\n',
-    );
+    return JSON.stringify(createOpenApiDocument(app), null, 2) + '\n';
  } finally {
    await app.close();
  }
 }

-generate().catch((error) => {
-  console.error(error);
-  process.exitCode = 1;
-});
+// Read-only: compares the runtime document with the committed artifact and never writes.
+async function check(content) {
+  const current = await readFile(target, 'utf8').catch(() => null);
+  if (current !== content) {
+    console.error(
+      'openapi.json is out of date with the runtime schema. Run `npm run openapi:generate`.',
+    );
+    process.exitCode = 1;
+    return;
+  }
+  console.log('openapi.json matches the runtime schema.');
+}
+
+// Atomic update: write a sibling temp file, then rename over the target, so a failed run never leaves partial output.
+async function update(content) {
+  const temp = `${target}.${process.pid}.tmp`;
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Operator-selected working directory and fixed artifact name; no request input.
+    await writeFile(temp, content);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- Operator-selected working directory and fixed artifact name; no request input.
+    await rename(temp, target);
+  } finally {
+    await rm(temp, { force: true });
+  }
+}
+
+render()
+  .then((content) => (checkOnly ? check(content) : update(content)))
+  .catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
@@ -1,6 +1,6 @@
 import { BadRequestException, ValidationPipe } from '@nestjs/common';

-import { CredentialsDto } from '../modules/auth/presentation/auth.dto';
+import { LoginDto, RegisterDto } from '../modules/auth/presentation/auth.dto';
 import {
  CreateBankCardDto,
  UpdateBankCardDto,
@@ -11,7 +11,7 @@ describe('DTO validation', () => {
    forbidUnknownValues: true, transform: true, whitelist: true });

  it('requires credentials and normalizes a valid email', async () => {
-    const metadata = { type: 'body' as const, metatype: CredentialsDto };
+    const metadata = { type: 'body' as const, metatype: RegisterDto };
    await expect(pipe.transform({}, metadata)).rejects.toBeInstanceOf(
      BadRequestException,
    );
@@ -29,6 +29,59 @@ describe('DTO validation', () => {
    });
  });

+  // Test intent: register accepts 8..72 printable ASCII characters only (bcrypt
+  // reads 72 bytes, so non-ASCII could be silently truncated); login only caps
+  // bytes so accounts created under the older policy can still sign in.
+  describe('password policy', () => {
+    const register = { type: 'body' as const, metatype: RegisterDto };
+    const login = { type: 'body' as const, metatype: LoginDto };
+    const body = (password: string) => ({ email: 'user@example.com', password });
+    const accepts = (value: unknown, metadata: typeof login | typeof register) =>
+      pipe.transform(value, metadata).then(
+        () => true,
+        (error: unknown) => {
+          if (!(error instanceof BadRequestException)) throw error;
+          return false;
+        },
+      );
+
+    it.each([
+      ['7 chars', 'a'.repeat(7), false],
+      ['8 chars', 'a'.repeat(8), true],
+      ['72 chars', 'a'.repeat(72), true],
+      ['73 chars', 'a'.repeat(73), false],
+      ['all printable symbols and space', 'Aa1 !~"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}', true],
+      ['Cyrillic, 8+ chars', 'пароль-пароль', false],
+      ['emoji', 'passw😀rd', false],
+      ['tab', 'pass\tword1', false],
+      ['newline', 'password1\n', false],
+      ['DEL', 'password\x7f1', false],
+      ['non-string', 12345678, false],
+    ])('register: %s', async (_, password, accepted) => {
+      await expect(accepts(body(password as string), register)).resolves.toBe(accepted);
+    });
+
+    it('register keeps raw whitespace untouched', async () => {
+      const password = '  spaced pass  ';
+      await expect(pipe.transform(body(password), register)).resolves.toEqual(
+        body(password),
+      );
+    });
+
+    it.each([
+      ['legacy Cyrillic password', 'пароль-пароль', true],
+      ['short legacy password', 'short', true],
+      ['72 bytes', 'a'.repeat(72), true],
+      ['73 bytes', 'a'.repeat(73), false],
+      ['36 Cyrillic letters = 72 bytes', 'я'.repeat(36), true],
+      ['37 Cyrillic letters = 74 bytes', 'я'.repeat(37), false],
+      ['empty', '', false],
+      ['non-string', 12345678, false],
+    ])('login: %s', async (_, password, accepted) => {
+      await expect(accepts(body(password as string), login)).resolves.toBe(accepted);
+    });
+  });
+
  it('requires and validates nested money in a new card', async () => {
    const metadata = { type: 'body' as const, metatype: CreateBankCardDto };
    const card = {
@@ -18,6 +18,7 @@ const allowedFields = new Set([
  'grpcCode',
  'headersReceived',
  'method',
+  'networkMs',
  'operation',
  'queueWaitMs',
  'requestId',
@@ -121,19 +121,11 @@ export class TbankAccessService {
    return work ? this.tokens.decrypt(work.connection.encryptedToken) : null;
  }

-  async onlineToken(userId: string) {
-    const connection = await this.prisma.tbankConnection.findUnique({
-      where: { userId },
-      select: { encryptedToken: true, invalidToken: true },
-    });
-    if (!connection) throw new ConflictException({ code: TbankErrorCode.NotConnected });
-    if (connection.invalidToken) {
-      throw new BadRequestException({ code: TbankErrorCode.InvalidToken });
-    }
-    return this.tokens.decrypt(connection.encryptedToken);
-  }
-
-  async current(userId: string): Promise<{ revision: string; token: string }> {
+  // Online reads: a permanent upstream auth refusal becomes 400/INVALID_TBANK_TOKEN here, once, for every caller.
+  async online<T>(
+    userId: string,
+    run: (connection: { revision: string; token: string }) => Promise<T>,
+  ): Promise<T> {
    const connection = await this.prisma.tbankConnection.findUnique({
      where: { userId },
      select: { encryptedToken: true, invalidToken: true, revision: true },
@@ -142,7 +134,8 @@ export class TbankAccessService {
    if (connection.invalidToken) {
      throw new BadRequestException({ code: TbankErrorCode.InvalidToken });
    }
-    return { revision: connection.revision, token: this.tokens.decrypt(connection.encryptedToken) };
+    const token = this.tokens.decrypt(connection.encryptedToken);
+    return this.tokens.translateInvalidToken(() => run({ revision: connection.revision, token }));
  }

  async publishMembership(
@@ -165,6 +165,8 @@ describe('TbankClient operations', () => {
        operation: 'getAccounts', grpcCode: status.DEADLINE_EXCEEDED,
        queueWaitMs: 0, channelState: 'CONNECTING', headersReceived: false,
      }));
+      const [, , fields] = logger.event.mock.calls.at(-1) as [string, string, { networkMs: unknown }];
+      expect(typeof fields.networkMs).toBe('number');
      expect(JSON.stringify(logger.event.mock.calls)).not.toContain('secret');
    } finally {
      jest.useRealTimers();
@@ -64,6 +64,7 @@ type TbankClientService = Client & Record<string, Unary<never, never>>;
 type RpcDiagnostics = {
  channelState?: string;
  headersReceived?: boolean;
+  networkMs?: number;
  queueWaitMs?: number;
  trackingId?: string;
 };
@@ -524,10 +525,13 @@ export class TbankClient {
          throw new ServiceUnavailableException({ code: TbankErrorCode.Unavailable });
        }
        const response = await this.queue.run(() => {
-          diagnostics.queueWaitMs = Math.round(performance.now() - startedAt);
+          const sentAt = performance.now();
+          diagnostics.queueWaitMs = Math.round(sentAt - startedAt);
          return this.request<Response>(
            token, client, method, request, diagnostics,
-          );
+          ).finally(() => {
+            diagnostics.networkMs = Math.round(performance.now() - sentAt);
+          });
        });
        this.logger.event('debug', 'tbank.rpc.completed', {
          operation: method,
@@ -24,7 +24,7 @@ import { ApiProblemResponses } from '../../../common/decorators/api-safe-error-r
 import { HttpErrorCode } from '../../../common/error-code';
 import { AuthService } from '../application/auth.service';
 import { AccessPayload, AuthenticationResult } from '../application/auth.types';
-import { CredentialsDto } from './auth.dto';
+import { LoginDto, RegisterDto } from './auth.dto';
 import { JwtAuthGuard } from './jwt-auth.guard';

 const REFRESH_COOKIE = 'refresh_token';
@@ -56,7 +56,7 @@ export class AuthController {
  @HttpCode(HttpStatus.OK)
  @ApiOkResponse({ type: AuthenticationDto })
  async register(
-    @Body() credentials: CredentialsDto,
+    @Body() credentials: RegisterDto,
    @Res({ passthrough: true }) response: Response,
  ) {
    return this.respond(
@@ -69,7 +69,7 @@ export class AuthController {
  @HttpCode(HttpStatus.OK)
  @ApiOkResponse({ type: AuthenticationDto })
  async login(
-    @Body() credentials: CredentialsDto,
+    @Body() credentials: LoginDto,
    @Res({ passthrough: true }) response: Response,
  ) {
    return this.respond(
@@ -1,8 +1,9 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Transform } from 'class-transformer';
 import {
+  IsNotEmpty,
  IsString,
-  MinLength,
+  Matches,
  Validate,
  ValidatorConstraint,
 } from 'class-validator';
@@ -13,8 +14,10 @@ const FIRST_CHARACTER_INDEX = 0;
 const MAX_EMAIL_LENGTH = 254;
 const ASCII_SPACE = 32;
 const ASCII_DELETE = 127;
-const MIN_PASSWORD_LENGTH = 12;
+// bcrypt reads at most 72 bytes; printable ASCII keeps characters == bytes.
+const MIN_PASSWORD_LENGTH = 8;
 const MAX_PASSWORD_BYTES = 72;
+const PASSWORD_PATTERN = `^[\\x20-\\x7E]{${MIN_PASSWORD_LENGTH},${MAX_PASSWORD_BYTES}}$`;

@ValidatorConstraint({ name: 'email' })
 class EmailConstraint {
@@ -40,8 +43,9 @@ class EmailConstraint {
  }
 }

-@ValidatorConstraint({ name: 'passwordBytes' })
-class PasswordBytesConstraint {
+// Login stays lenient: accounts created under an older policy must still sign in.
+@ValidatorConstraint({ name: 'passwordMaxBytes' })
+class PasswordMaxBytesConstraint {
  validate(value: unknown): boolean {
    return (
      typeof value === 'string' &&
@@ -50,11 +54,11 @@ class PasswordBytesConstraint {
  }

  defaultMessage(): string {
-    return 'must not exceed 72 UTF-8 bytes';
+    return `must not exceed ${MAX_PASSWORD_BYTES} UTF-8 bytes`;
  }
 }

-export class CredentialsDto {
+class EmailDto {
  @ApiProperty({ example: 'user@example.com' })
  @IsString()
  @Transform(({ value }: { value: unknown }) =>
@@ -62,14 +66,28 @@ export class CredentialsDto {
  )
  @Validate(EmailConstraint)
  declare email: string;
+}

+export class RegisterDto extends EmailDto {
  @ApiProperty({
-    minLength: MIN_PASSWORD_LENGTH,
-    maxLength: MAX_PASSWORD_BYTES,
+    description: `Raw password: ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.`,
+    pattern: PASSWORD_PATTERN,
    example: 'a secure password',
  })
  @IsString()
-  @MinLength(MIN_PASSWORD_LENGTH)
-  @Validate(PasswordBytesConstraint)
+  @Matches(new RegExp(PASSWORD_PATTERN), {
+    message: `must be ${MIN_PASSWORD_LENGTH}-${MAX_PASSWORD_BYTES} printable ASCII characters`,
+  })
+  declare password: string;
+}
+
+export class LoginDto extends EmailDto {
+  @ApiProperty({
+    description: `Raw password, at most ${MAX_PASSWORD_BYTES} UTF-8 bytes. Not trimmed or normalized.`,
+    example: 'a secure password',
+  })
+  @IsString()
+  @IsNotEmpty()
+  @Validate(PasswordMaxBytesConstraint)
  declare password: string;
 }
@@ -91,6 +91,101 @@ export class BankOperationsService {
    };
  }

+  private async pageViews(tx: Tx, rows: BankCardOperation[]) {
+    const userId = rows[0]?.userId;
+    if (!userId) return [];
+    const cardIds = new Set(
+      rows.flatMap((row) =>
+        [row.cardId, row.targetCardId].filter(
+          (id): id is string => id !== null,
+        ),
+      ),
+    );
+    const sourceIds = new Set(
+      rows.flatMap((row) => (row.originalExpenseId ? [row.originalExpenseId] : [])),
+    );
+    const [cards, sources] = await Promise.all([
+      tx.bankCard.findMany({ where: { userId, id: { in: [...cardIds] } } }),
+      tx.bankCardOperation.findMany({
+        where: { userId, id: { in: [...sourceIds] } },
+      }),
+    ]);
+    const categoryIds = new Set(
+      rows
+        .map(
+          (row) =>
+            sources.find((source) => source.id === row.originalExpenseId)
+              ?.categoryId ?? row.categoryId,
+        )
+        .filter((id): id is string => id !== null),
+    );
+    const expenseIds = new Set(
+      rows.flatMap((row) => {
+        const source = sources.find((item) => item.id === row.originalExpenseId);
+        return row.kind === BankOperationKind.Expense || source
+          ? [source?.id ?? row.id]
+          : [];
+      }),
+    );
+    const [categories, refunds] = await Promise.all([
+      tx.expenseCategory.findMany({
+        where: { userId, id: { in: [...categoryIds] } },
+      }),
+      tx.bankCardOperation.findMany({
+        where: {
+          userId,
+          originalExpenseId: { in: [...expenseIds] },
+          deletedAt: null,
+        },
+      }),
+    ]);
+    const cardsById = new Map(cards.map((card) => [card.id, card]));
+    const sourcesById = new Map(sources.map((source) => [source.id, source]));
+    const categoriesById = new Map(categories.map((category) => [category.id, category]));
+    return rows.map((row) => {
+      const card = cardsById.get(row.cardId) as { name: string };
+      const target = row.targetCardId ? cardsById.get(row.targetCardId) : null;
+      const source = row.originalExpenseId
+        ? sourcesById.get(row.originalExpenseId)
+        : null;
+      const categoryId = source?.categoryId ?? row.categoryId;
+      const relatedRefunds =
+        row.kind === BankOperationKind.Expense || source
+          ? refunds.filter(
+              (refund) =>
+                refund.originalExpenseId === (source?.id ?? row.id) &&
+                (!source || refund.id !== row.id),
+            )
+          : [];
+      return {
+        id: row.id,
+        kind: row.kind as BankOperationDto['kind'],
+        cardId: row.cardId,
+        cardName: card.name,
+        targetCardId: row.targetCardId,
+        targetCardName: target?.name ?? null,
+        categoryId,
+        categoryName: categoriesById.get(categoryId ?? '')?.name ?? null,
+        originalExpenseId: row.originalExpenseId,
+        amount: rubMoney(row.amountKopecks),
+        availableRefund:
+          row.kind === BankOperationKind.Expense || source
+            ? rubMoney(
+                (source?.amountKopecks ?? row.amountKopecks) -
+                relatedRefunds.reduce(
+                  (sum, refund) => sum + refund.amountKopecks,
+                  ZERO_KOPECKS,
+                ),
+              )
+            : null,
+        date: row.date,
+        description: row.description,
+        version: row.version,
+        createdAt: row.createdAt.toISOString(),
+      };
+    });
+  }
+
  private async validateOperation(
    tx: Tx,
    userId: string,
@@ -359,9 +454,7 @@ export class BankOperationsService {
        take: limit,
      });
      return {
-        items: await Promise.all(
-          rows.map((row) => this.operationView(tx, row)),
-        ),
+        items: await this.pageViews(tx, rows),
        total,
        page,
        hasNext: page * limit < total,
@@ -3,7 +3,7 @@ import { createHash } from 'node:crypto';

 import { investmentResourceMeta } from '../investment-resource.mapper';
 import { PortfolioService } from '../portfolio/portfolio.api';
-import { TbankSyncRepository } from '../tbank-sync/tbank-sync.repository';
+import { hourlyAttempt, TbankSyncRepository } from '../tbank-sync/tbank-sync.repository';
 import { BrokerageAccountDto, BrokerageAccountsResourceDto } from './brokerage-account.dto';

@Injectable()
@@ -61,6 +61,7 @@ export class BrokerageAccountsService {
          : null,
        freshForMs: 3_600_000,
        work: null,
+        lastAttempt: hourlyAttempt(hourly, ['membership', 'portfolio']),
        dependencies: saved.accounts.map((account) => account.meta),
      }),
      sync: hourly
@@ -98,6 +98,7 @@ export class IncomeAnalyticsService {
        work: work.id
          ? { id: work.id, state: work.state, errorCode: work.errorCode }
          : null,
+        lastAttempt: current.meta.lastAttempt,
        coverage: current.meta.coverage,
        dependencies,
      }),
@@ -3,15 +3,11 @@ import {
  Injectable,
  NotFoundException,
 } from '@nestjs/common';
-import { randomUUID } from 'node:crypto';

-import { StructuredLogger } from '../../../../common/logging/structured-logger.service';
-import { isTbankErrorCode, TbankErrorCode } from '../../../../integrations/tbank/tbank-error-code';
 import {
  TbankAccessService,
  TbankClient,
  tbankSourceTtlMs,
-  type TbankSyncAttempt,
 } from '../../../../integrations/tbank/tbank.api';
 import { investmentResourceMeta } from '../../investment-resource.mapper';
 import { InstrumentErrorCode } from '../domain/instrument-error-code';
@@ -31,42 +27,22 @@ import { publicInstrument } from './public-instrument';
 const UNAMBIGUOUS_MATCH_COUNT = 1;
 const NO_MATCHES = 0;
 const FIRST_RESULT_OFFSET = 0;
-const MISSING_DATA_REVISION = '0';

 const tickerAmbiguityLimit = 2;

-type Producer = {
-  attempt: TbankSyncAttempt;
-  force: boolean;
-  input: CatalogQuery;
-  observers: TbankSyncAttempt[];
-};
@Injectable()
 export class CatalogDiscoveryService {
-  private readonly runId = randomUUID();
-  private readonly active = new Set<string>();
-  private readonly producers = new Map<string, Producer>();
-  private readonly queue: Producer[] = [];
-  private reservations: Promise<unknown> = Promise.resolve();
-  private running = false;
-  private readonly completions = new Map<
-    string,
-    { done: Promise<void>; resolve: () => void; workId: string }
-  >();
-
  constructor(
    private readonly repository: CatalogDiscoveryRepository,
    private readonly access: TbankAccessService,
    private readonly tbank: TbankClient,
-    private readonly logger: StructuredLogger,
    private readonly enrichment: CatalogEnrichmentService,
  ) {}

-  async read(userId: string, input: CatalogQuery, observe = false) {
+  async read(userId: string, input: CatalogQuery) {
    input = catalogQuery(input);
    const connection = await this.access.local(userId);
    const saved = await this.repository.read(input);
-    if (!observe) await this.request(userId, connection.revision, input);
    return {
      data: saved.data,
      meta: investmentResourceMeta({
@@ -82,7 +58,7 @@ export class CatalogDiscoveryService {

  async search(userId: string, input: CatalogQuery, observe = false) {
    if (!observe) return this.onlineSearch(userId, catalogQuery(input));
-    const discovery = await this.read(userId, input, observe);
+    const discovery = await this.read(userId, input);
    const sources = discovery.data
      ? await this.enrichment.readMany(
          userId,
@@ -146,11 +122,11 @@ export class CatalogDiscoveryService {
    observe = false,
  ) {
    if (!observe) {
-      const token = await this.access.onlineToken(userId);
-      const instrument =
+      const instrument = await this.access.online(userId, ({ token }) =>
        instrumentType === 'share'
-          ? await this.tbank.getShare(token, uid)
-          : await this.tbank.getBond(token, uid);
+          ? this.tbank.getShare(token, uid)
+          : this.tbank.getBond(token, uid),
+      );
      if (!instrument) throw new NotFoundException();
      return {
        data: { ...publicInstrument({ ...instrument, uid }), uid, slug: instrument.ticker?.toUpperCase() ?? uid },
@@ -182,11 +158,11 @@ export class CatalogDiscoveryService {
      instrument?.ticker &&
      /^[A-Z0-9][\w.@+-]{0,79}$/i.test(instrument.ticker)
    ) {
-      const alias = await this.read(
-        userId,
-        { instrumentType, query: instrument.ticker, exactTicker: true },
-        observe,
-      );
+      const alias = await this.read(userId, {
+        instrumentType,
+        query: instrument.ticker,
+        exactTicker: true,
+      });
      if (alias.data?.length === UNAMBIGUOUS_MATCH_COUNT && alias.data[0].uid === uid) {
        slug = instrument.ticker.toUpperCase();
      }
@@ -225,11 +201,11 @@ export class CatalogDiscoveryService {
  ) {
    if (!observe) {
      const query = ticker.trim().toUpperCase();
-      const token = await this.access.onlineToken(userId);
-      const found =
+      const found = await this.access.online(userId, ({ token }) =>
        instrumentType === 'share'
-          ? await this.tbank.findShares(token, query)
-          : await this.tbank.findBonds(token, query);
+          ? this.tbank.findShares(token, query)
+          : this.tbank.findBonds(token, query),
+      );
      const matches = selectCatalogInstruments(
        found.filter((item) => item.ticker?.trim().toUpperCase() === query),
        query,
@@ -247,11 +223,11 @@ export class CatalogDiscoveryService {
      const result = await this.detail(userId, instrumentType, matches[0].uid);
      return { ...result, data: result.data ? { ...result.data, slug: query } : null };
    }
-    const lookup = await this.read(
-      userId,
-      { instrumentType, query: ticker, exactTicker: true },
-      observe,
-    );
+    const lookup = await this.read(userId, {
+      instrumentType,
+      query: ticker,
+      exactTicker: true,
+    });
    if (lookup.data?.length === NO_MATCHES) throw new NotFoundException();
    if (lookup.data && lookup.data.length > UNAMBIGUOUS_MATCH_COUNT) {
      throw new ConflictException({
@@ -292,28 +268,32 @@ export class CatalogDiscoveryService {
  }

  private async onlineSearch(userId: string, input: CatalogQuery) {
-    const token = await this.access.onlineToken(userId);
-    const found =
-      input.instrumentType === 'share'
-        ? await this.tbank.findShares(token, input.query)
-        : await this.tbank.findBonds(token, input.query);
-    const instruments = selectCatalogInstruments(
-      input.exactTicker
-        ? found.filter((item) => item.ticker?.trim().toUpperCase() === input.query)
-        : found,
-      input.query,
-      input.instrumentType,
-    ).slice(FIRST_RESULT_OFFSET, input.exactTicker ? tickerAmbiguityLimit : catalogSearchLimit);
-    const details = await Promise.all(
-      instruments.map((item) =>
+    const { details, instruments, prices } = await this.access.online(userId, async ({ token }) => {
+      const found =
        input.instrumentType === 'share'
-          ? this.tbank.getShare(token, item.uid)
-          : this.tbank.getBond(token, item.uid),
-      ),
-    );
-    const prices = instruments.length
-      ? await this.tbank.getLastPrices(token, instruments.map((item) => item.uid))
-      : [];
+          ? await this.tbank.findShares(token, input.query)
+          : await this.tbank.findBonds(token, input.query);
+      const instruments = selectCatalogInstruments(
+        input.exactTicker
+          ? found.filter((item) => item.ticker?.trim().toUpperCase() === input.query)
+          : found,
+        input.query,
+        input.instrumentType,
+      ).slice(FIRST_RESULT_OFFSET, input.exactTicker ? tickerAmbiguityLimit : catalogSearchLimit);
+      const [details, prices] = await Promise.all([
+        Promise.all(
+          instruments.map((item) =>
+            input.instrumentType === 'share'
+              ? this.tbank.getShare(token, item.uid)
+              : this.tbank.getBond(token, item.uid),
+          ),
+        ),
+        instruments.length
+          ? this.tbank.getLastPrices(token, instruments.map((item) => item.uid))
+          : [],
+      ]);
+      return { details, instruments, prices };
+    });
    const fetchedAt = new Date();
    const data = instruments.flatMap((item, index) => {
      const detail = details.at(index);
@@ -335,162 +315,4 @@ export class CatalogDiscoveryService {
      }),
    };
  }
-
-  request(
-    userId: string,
-    revision: string,
-    query: CatalogQuery,
-    force = false,
-  ) {
-    const input = catalogQuery(query);
-    const reserved = this.reservations.then(async () => {
-      const saved = await this.repository.read(input);
-      if (
-        !force &&
-        saved.dataRevision !== MISSING_DATA_REVISION
-      ) return null;
-      const reservation = await this.repository.reserve(
-        { userId, revision },
-        input,
-        this.runId,
-        this.active,
-      );
-      if (!reservation) return null;
-      const { id, attemptId } = reservation.work;
-      if (!reservation.launch) {
-        const current = this.producers.get(catalogScope(input));
-        if (current) current.force ||= force;
-        return id;
-      }
-      const attempt = { userId, revision, id, attemptId };
-      this.active.add(attemptId);
-      let resolve = () => {};
-      const done = new Promise<void>((finish) => {
-        resolve = finish;
-      });
-      this.completions.set(attemptId, { workId: id, done, resolve });
-      const key = catalogScope(input);
-      const producer = this.producers.get(key);
-      if (producer) {
-        producer.observers.push(attempt);
-        producer.force ||= force;
-      } else {
-        const queued = { input, attempt, observers: [], force };
-        this.producers.set(key, queued);
-        this.queue.push(queued);
-      }
-      if (!this.running) {
-        this.running = true;
-        setImmediate(() => {
-          void this.drain();
-        });
-      }
-      return id;
-    });
-    this.reservations = reserved.catch(() => undefined);
-    return reserved;
-  }
-
-  async refresh(userId: string, revision: string, query: CatalogQuery) {
-    const id = await this.request(userId, revision, query, true);
-    if (id) {
-      await Promise.all(
-        [...this.completions.values()]
-          .filter((entry) => entry.workId === id)
-          .map((entry) => entry.done),
-      );
-    }
-    const saved = await this.repository.read(catalogQuery(query));
-    const sources = await this.enrichment.readMany(
-      userId,
-      query.instrumentType,
-      saved.data?.map((item) => item.uid) ?? [],
-      true,
-    );
-    return [
-      ...(id ? [id] : []),
-      ...sources.flatMap((source) =>
-        source.meta.sync.id ? [source.meta.sync.id] : [],
-      ),
-    ];
-  }
-
-  private async drain() {
-    try {
-      while (this.queue.length) {
-        const producer = this.queue.shift();
-        if (!producer) break;
-        const { input, attempt } = producer;
-        let success = false;
-        try {
-          const token = await this.access.tokenForAttempt(attempt);
-          if (token) {
-            const found =
-              input.instrumentType === 'share'
-                ? await this.tbank.findShares(token, input.query)
-                : await this.tbank.findBonds(token, input.query);
-            success = await this.repository.publish(
-              attempt,
-              input,
-              selectCatalogInstruments(
-                input.exactTicker
-                  ? found.filter(
-                      (item) =>
-                        item.ticker?.trim().toUpperCase() === input.query,
-                    )
-                  : found,
-                input.query,
-                input.instrumentType,
-              ).slice(
-                FIRST_RESULT_OFFSET,
-                input.exactTicker ? tickerAmbiguityLimit : catalogSearchLimit,
-              ),
-              new Date(),
-            );
-          }
-        } catch (error) {
-          if (error instanceof Error && isTbankErrorCode(error.message, TbankErrorCode.InvalidToken)) {
-            await this.access.rejectMembershipToken(attempt);
-          } else {
-            this.logger.event('warn', 'catalog-discovery.failed', {
-              code: TbankErrorCode.Unavailable,
-            });
-          }
-        }
-        if (success) {
-          const saved = await this.repository.read(input);
-          for (const observer of [attempt, ...producer.observers]) {
-            if (!input.exactTicker || saved.data?.length === UNAMBIGUOUS_MATCH_COUNT) {
-              await this.enrichment.requestMany(
-                observer.userId,
-                observer.revision,
-                input.instrumentType,
-                saved.data?.map((item) => item.uid) ?? [],
-                producer.force,
-                input.exactTicker ? ['detail'] : ['last-price', 'detail'],
-              );
-            }
-          }
-        }
-        this.producers.delete(catalogScope(input));
-        for (const observer of [attempt, ...producer.observers]) {
-          await this.repository.finish(observer, success);
-          this.active.delete(observer.attemptId);
-          this.completions.get(observer.attemptId)?.resolve();
-          this.completions.delete(observer.attemptId);
-        }
-      }
-    } catch {
-      for (const completion of this.completions.values()) completion.resolve();
-      this.completions.clear();
-      this.active.clear();
-      this.producers.clear();
-      this.queue.length = 0;
-      this.logger.event('error', 'catalog-discovery.persistence-failed', {
-        code: TbankErrorCode.Unavailable,
-      });
-    } finally {
-      this.running = false;
-    }
-  }
 }
@@ -231,7 +231,6 @@ export class CatalogEnrichmentService {
    return reservation;
  }

-  // eslint-disable-next-line sonarjs/cognitive-complexity -- Section composition owns the source dependency policy.
  async section(
    userId: string,
    instrumentType: 'bond' | 'share',
@@ -240,18 +239,20 @@ export class CatalogEnrichmentService {
    observe = false,
  ) {
    if (section === 'company' && !observe) {
-      const token = await this.access.onlineToken(userId);
-      const instrument =
-        instrumentType === 'share'
-          ? await this.tbank.getShare(token, uid)
-          : await this.tbank.getBond(token, uid);
-      if (!instrument) throw new NotFoundException();
-      const [description, fundamentals] = instrument.assetUid
-        ? await Promise.all([
-            this.tbank.getAssetDescription(token, instrument.assetUid),
-            this.tbank.getFundamentals(token, instrument.assetUid),
-          ])
-        : [null, null];
+      const { description, fundamentals, instrument } = await this.access.online(userId, async ({ token }) => {
+        const instrument =
+          instrumentType === 'share'
+            ? await this.tbank.getShare(token, uid)
+            : await this.tbank.getBond(token, uid);
+        if (!instrument) throw new NotFoundException();
+        const [description, fundamentals] = instrument.assetUid
+          ? await Promise.all([
+              this.tbank.getAssetDescription(token, instrument.assetUid),
+              this.tbank.getFundamentals(token, instrument.assetUid),
+            ])
+          : [null, null];
+        return { description, fundamentals, instrument };
+      });
      const meta = investmentResourceMeta({
        resourceKey: `${instrumentType}/company/${uid}`,
        dataRevision: `online:${Date.now()}`,
@@ -22,14 +22,16 @@ function share(index: number, overrides: Partial<TbankShare> = {}): TbankShare {
 }

 describe('StockScreenerService', () => {
-  const access = { current: jest.fn(), local: jest.fn() };
+  const access = { online: jest.fn(), local: jest.fn() };
  const client = { getAllShares: jest.fn() };
  const logger = { event: jest.fn() };
  let service: StockScreenerService;

  beforeEach(() => {
    jest.clearAllMocks();
-    access.current.mockResolvedValue({ revision, token });
+    access.online.mockImplementation((_userId: string, run: (connection: { revision: string; token: string }) => Promise<unknown>) =>
+      run({ revision, token }),
+    );
    access.local.mockResolvedValue({ revision });
    client.getAllShares.mockResolvedValue(
      Array.from({ length: pageSize + 1 }, (_, index) => share(index)),
@@ -48,8 +48,8 @@ type StockScreenerPage = {
 };
 type Snapshot = { asOf: string; expiresAt: number; items: StockScreenerItem[]; revision: string; userId: string };
 type TbankAccess = {
-  current(userId: string): Promise<{ revision: string; token: string }>;
  local(userId: string): Promise<{ revision: string }>;
+  online<T>(userId: string, run: (connection: { revision: string; token: string }) => Promise<T>): Promise<T>;
 };

@Injectable()
@@ -63,8 +63,10 @@ export class StockScreenerService {
  ) {}

  async search(userId: string, conditions: StockScreenerConditions): Promise<StockScreenerPage> {
-    const connection = await this.access.current(userId);
-    const instruments = await this.client.getAllShares(connection.token);
+    const { instruments, revision } = await this.access.online(userId, async (connection) => ({
+      instruments: await this.client.getAllShares(connection.token),
+      revision: connection.revision,
+    }));
    const asOf = new Date().toISOString();
    const selected = selectStockScreenerInstruments({ asOf: new Date(asOf), instruments }, conditions)
      .instruments.map((instrument) => this.item(instrument));
@@ -74,7 +76,7 @@ export class StockScreenerService {
      asOf,
      expiresAt: Date.now() + SNAPSHOT_TTL_MS,
      items: selected,
-      revision: connection.revision,
+      revision,
      userId,
    });
    this.logger.event('info', 'stock.screener.search.completed', { asOf, count: selected.length, operation: 'stock-screener-search' });
@@ -93,7 +93,7 @@ export class StockScreenerItemDto {
  @ApiProperty({ nullable: true, type: String }) declare currency: null | string;
  @ApiProperty({ nullable: true, type: String }) declare realExchange: null | string;
  @ApiProperty({ nullable: true, type: String }) declare countryOfRisk: null | string;
-  @ApiProperty({ nullable: true, type: 'integer' }) declare lot: null | number;
+  @ApiProperty({ nullable: true, minimum: MIN_TICKER_LENGTH, type: 'integer' }) declare lot: null | number;
 }

 export class StockScreenerPageDto {
@@ -435,6 +435,7 @@ export class BrokerageOperationsService {
      saved = await this.repository.readPage(input);
    }
    const now = new Date();
+    const hourly = await this.hourlySync.hourly(userId);
    const membership = investmentResourceMeta({
      resourceKey: 'accounts/membership',
      dataRevision: String(saved?.connection.membershipRevision ?? MISSING_MEMBERSHIP_REVISION),
@@ -503,6 +504,7 @@ export class BrokerageOperationsService {
        fetchedAt,
        freshForMs: plan.intervals.some((range) => range.stale) ? STALE_FRESHNESS_MS : Infinity,
        work,
+        lastAttempt: hourlyAttempt(hourly, 'operations', accountId === 'all' ? undefined : accountId),
        dependencies: [membership],
        coverage: {
          requested: targets.map(serialize),
@@ -1,4 +1,4 @@
-import { setImmediate as immediate } from 'node:timers/promises';
+import assert from 'node:assert/strict';
 jest.mock('../../../../prisma/prisma.service', () => ({
  PrismaService: class {},
 }));
@@ -97,14 +97,9 @@ describe('persistent portfolio projection', () => {
      ],
      work: [],
    });
-    await service.request('user', 'private', 'a');
-    for (
-      let index = 0;
-      index < 10 && !repository.publish.mock.calls.length;
-      index += 1
-    ) {
-      await immediate();
-    }
+    const handle = await service.request('user', 'private', 'a');
+    assert(handle);
+    await handle.done;
    const snapshot = (
      repository.publish.mock.calls as [unknown, string, PortfolioDto][]
    )[0][2];
@@ -147,10 +142,9 @@ describe('persistent portfolio projection', () => {
      { units: '99' },
      { currency: 'EUR', units: '1' },
    ] });
-    await service.request('user', 'private', 'a');
-    for (let index = 0; index < 10 && !repository.publish.mock.calls.length; index++) {
-      await immediate();
-    }
+    const handle = await service.request('user', 'private', 'a');
+    assert(handle);
+    await handle.done;
    const snapshot = (repository.publish.mock.calls as [unknown, string, PortfolioDto][])[0][2];
    expect(snapshot.cashBalances).toEqual([
      { currency: 'RUB', value: '0' },
@@ -209,13 +209,6 @@ export const investmentScreenSchema = {
  },
 };

-export class TbankSyncAcceptedDto {
-  @ApiProperty({ format: 'uuid' }) declare id: string;
-  @ApiProperty({ type: Object, ...investmentScreenSchema })
-  declare scope: InvestmentScreenDto;
-
-  @ApiProperty({ format: 'date-time' }) declare now: string;
-}
 export class TbankSyncStatusDto {
  @ApiProperty({ format: 'uuid' }) declare id: string;
  @ApiProperty({ type: Object, ...investmentScreenSchema, nullable: true })
@@ -229,26 +222,6 @@ export class TbankSyncStatusDto {
    null | string;
 }

-export class HourlySyncSectionDto {
-  @ApiProperty({ enum: ['membership', 'portfolio', 'operations', 'events'] })
-  declare section: 'events' | 'membership' | 'operations' | 'portfolio';
-
-  @ApiPropertyOptional({
-    type: String,
-    nullable: false,
-    description: 'Account identifier of the problematic section, when scoped.',
-  })
-  declare accountId?: string;
-
-  @ApiProperty({
-    type: String,
-    nullable: true,
-    description:
-      'Safe error code of the failed section. No tokens or upstream payloads.',
-  })
-  declare errorCode: null | string;
-}
-
 export class HourlySyncStatusDto {
  @ApiProperty({
    enum: ['running', 'succeeded', 'partial', 'failed', 'cancelled'],
@@ -43,16 +43,17 @@ type HourlyAttempt = {

 export function hourlyAttempt(
  hourly: HourlyAttempt | null,
-  section: HourlySection['section'],
+  section: HourlySection['section'] | readonly HourlySection['section'][],
  accountId?: string,
 ): InvestmentAttemptDto {
  if (!hourly) {
    return { state: 'none', startedAt: null, finishedAt: null, problems: [] };
  }
+  const sections = Array.isArray(section) ? section : [section];
  const problems = hourly.sections
    .filter(
      (entry) =>
-        entry.section === section &&
+        sections.includes(entry.section) &&
        (accountId === undefined || entry.accountId === accountId),
    )
    .map((entry) => ({
@@ -182,7 +183,8 @@ export class TbankSyncRepository {

  // The timer only proposes work; this reservation is the durable fence. The
  // attempt start (createdAt) is the basis of the next hourly term, including
-  // failed and interrupted attempts.
+  // failed and interrupted attempts. After downtime the next tick is due at
+  // once, so no catch-up queue forms.
  reserveHourly(userId: string, runId: string, hourMs: number) {
    return this.prisma.$transaction(async (tx) => {
      const connection = await tx.tbankConnection.findFirst({
@@ -200,7 +202,16 @@ export class TbankSyncRepository {
      });
      const now = new Date();
      if (previous) {
-        const due = now.valueOf() - previous.createdAt.valueOf() >= hourMs;
+        // Terms are hourMs steps from the attempt start; a walk still running
+        // at a term consumes it. A dead process's attempt has no known end, so
+        // it consumes only its own term.
+        const started = previous.createdAt.valueOf();
+        const ended =
+          previous.state === 'running' ? started : previous.updatedAt.valueOf();
+        const dueAt =
+          started +
+          Math.max(hourMs, Math.ceil((ended - started) / hourMs) * hourMs);
+        const due = now.valueOf() >= dueAt;
        if (previous.state === 'running') {
          if (previous.processRunId === runId) return null;
          // A dead process cannot finish its attempt; close it from its
@@ -2,314 +2,27 @@ import {
  ConflictException,
  Injectable,
  NotFoundException,
-  ServiceUnavailableException,
 } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';

-import { ISO_DATE_LENGTH, ISO_DATE_START } from '../../../common/time';
-import { TbankErrorCode } from '../../../integrations/tbank/tbank-error-code';
-import {
-  InstrumentMetadataService,
-  TbankAccessService,
-  TbankMembershipService,
-  type TbankSyncAttempt,
-} from '../../../integrations/tbank/tbank.api';
-import {
-  CandleService,
-  CatalogDiscoveryService,
-  CatalogEnrichmentService,
-} from '../instruments/instruments.api';
-import { planInvestmentScreen } from '../investment-sync-plan';
-import {
-  BrokerageOperationsSyncService,
-  type OperationInterval,
-} from '../operations/operations.api';
-import { PortfolioService } from '../portfolio/portfolio.api';
-import { normalizeScreen } from './tbank-screen';
-import { InvestmentScreenDto, TbankSyncStatusDto } from './tbank-sync.dto';
+import { TbankAccessService } from '../../../integrations/tbank/tbank.api';
+import { BrokerageOperationsSyncService } from '../operations/operations.api';
+import { TbankSyncStatusDto } from './tbank-sync.dto';
 import {
  type ScreenIntent,
  TbankSyncRepository,
 } from './tbank-sync.repository';

-const FOREGROUND_CANDLE_PRIORITY = 0;
-
@Injectable()
 export class TbankSyncService {
  private readonly runId = randomUUID();
  private readonly startedAt = new Date();
-  private reservations: Promise<unknown> = Promise.resolve();
  constructor(
    private readonly repository: TbankSyncRepository,
    private readonly access: TbankAccessService,
-    private readonly membership: TbankMembershipService,
-    private readonly portfolio: PortfolioService,
    private readonly operations: BrokerageOperationsSyncService,
-    private readonly metadata: InstrumentMetadataService,
-    private readonly discovery: CatalogDiscoveryService,
-    private readonly sources: CatalogEnrichmentService,
-    private readonly candles: CandleService,
  ) {}

-  async request(userId: string, input: InvestmentScreenDto) {
-    const scope = normalizeScreen(input);
-    const connection = await this.access.local(userId, scope.accountId);
-    const reservation = this.reservations.then(() =>
-      this.repository.reserve(userId, connection.revision, scope, this.runId),
-    );
-    this.reservations = reservation.catch(() => undefined);
-    const reserved = await reservation;
-    if (!reserved) throw new ServiceUnavailableException();
-    const intent = reserved.work.intent as unknown as ScreenIntent;
-    if (reserved.launch) {
-      const attempt = {
-        userId,
-        revision: connection.revision,
-        id: reserved.work.id,
-        attemptId: reserved.work.attemptId,
-      };
-      setImmediate(() => {
-        void this.dispatch(attempt, intent);
-      });
-    }
-    return { id: reserved.work.id, ...intent };
-  }
-
-  private async dispatch(attempt: TbankSyncAttempt, intent: ScreenIntent) {
-    const children: string[] = [];
-    const add = async (ids: (null | string | undefined)[]) => {
-      children.push(...ids.filter((id): id is string => Boolean(id)));
-      await this.repository.progress(attempt, children, false);
-    };
-    try {
-      const { userId, revision } = attempt;
-      const { scope } = intent;
-      const now = new Date(intent.now);
-      const member = await this.membership.request(userId, revision, true);
-      await add([member?.id]);
-      await member?.done;
-      const current = await this.access.local(userId, scope.accountId);
-      if (current.revision !== revision) return;
-      const accountScope = scope.accountId ?? 'all';
-      const selectedAccounts = current.accounts.filter(
-        (account) =>
-          accountScope === 'all' || account.accountId === accountScope,
-      );
-      if (
-        ['account', 'accounts', 'bond', 'events', 'stock'].includes(
-          scope.screen,
-        )
-      ) {
-        for (const account of scope.screen === 'stock' ||
-          scope.screen === 'bond'
-          ? current.accounts
-          : selectedAccounts) {
-          const work = await this.portfolio.request(
-            userId,
-            revision,
-            account.accountId,
-            true,
-          );
-          await add([work?.id]);
-          await work?.done;
-        }
-      }
-      const saved = await this.portfolio.read(
-        userId,
-        scope.screen === 'stock' || scope.screen === 'bond'
-          ? 'all'
-          : accountScope,
-      );
-      const positions = saved.data?.positions ?? [];
-      const instruments = [
-        ...new Map(
-          positions.flatMap((position) =>
-            position.instrumentUid &&
-            (position.type === 'STOCK' || position.type === 'BOND')
-              ? [
-                  [
-                    position.instrumentUid,
-                    {
-                      uid: position.instrumentUid,
-                      type: position.type,
-                      historyFrom: null,
-                    },
-                  ] as const,
-                ]
-              : [],
-          ),
-        ).values(),
-      ];
-      const plan = planInvestmentScreen(
-        {
-          ...scope,
-          candleRange: scope.candleRange
-            ? {
-                from: new Date(scope.candleRange.from),
-                to: new Date(scope.candleRange.to),
-              }
-            : undefined,
-        },
-        {
-          accounts: selectedAccounts,
-          instruments:
-            scope.screen === 'stocks' || scope.screen === 'bonds'
-              ? []
-              : instruments,
-          membershipKnown: Boolean(current.membershipAt),
-        },
-        now,
-        true,
-      );
-      const intervals: OperationInterval[] = plan.sources.flatMap((source) =>
-        source.kind === 'operations' &&
-        source.accountId &&
-        source.from &&
-        source.to
-          ? [
-              {
-                accountId: source.accountId,
-                from: source.from,
-                to: source.to,
-                ...(source.instrumentUid
-                  ? { instrumentUid: source.instrumentUid }
-                  : {}),
-              },
-            ]
-          : [],
-      );
-      if (intervals.length) {
-        await add([
-          await this.operations.request(
-            userId,
-            intervals,
-            true,
-            'screen',
-            revision,
-          ),
-        ]);
-      }
-      for (const source of plan.sources) {
-        const uid = source.instrumentUid;
-        const type = source.instrumentType === 'BOND' ? 'bond' : 'share';
-        if (source.kind === 'catalog') {
-          await add(
-            await this.discovery.refresh(userId, revision, {
-              instrumentType: type,
-              query: source.query ?? '',
-            }),
-          );
-        }
-        if (!uid) continue;
-        if (source.kind === 'metadata') {
-          await add([
-            await this.metadata.request(userId, revision, {
-              instrumentUid: uid,
-            }),
-          ]);
-        }
-        if (source.kind === 'quote') {
-          await add(
-            await this.sources.requestMany(
-              userId,
-              revision,
-              type,
-              [uid],
-              true,
-              [
-                type === 'bond' ? 'bond-current' : 'detail',
-                'last-price',
-                'trading-status',
-                'comparison',
-              ],
-            ),
-          );
-        }
-        if (source.kind === 'company') {
-          await add(
-            await this.sources.requestMany(
-              userId,
-              revision,
-              type,
-              [uid],
-              true,
-              ['description', 'fundamentals'],
-            ),
-          );
-        }
-        if (source.kind === 'metrics') {
-          await add(
-            await this.sources.requestMany(
-              userId,
-              revision,
-              type,
-              [uid],
-              true,
-              ['coupons', 'yield', 'rating'],
-            ),
-          );
-        }
-        if (source.kind === 'calendar' && source.from && source.to) {
-          await add(
-            await this.sources.requestMany(
-              userId,
-              revision,
-              type,
-              [uid],
-              true,
-              [
-                type === 'share'
-                  ? 'dividends'
-                  : scope.screen === 'bond'
-                    ? 'coupons'
-                    : 'bond-events',
-              ],
-              {
-                from: source.from.toISOString().slice(ISO_DATE_START, ISO_DATE_LENGTH),
-                to: source.to.toISOString().slice(ISO_DATE_START, ISO_DATE_LENGTH),
-                ticker:
-                  positions.find((position) => position.instrumentUid === uid)
-                    ?.ticker ?? undefined,
-              },
-            ),
-          );
-        }
-      }
-      if (
-        (scope.screen === 'stock' || scope.screen === 'bond') &&
-        scope.instrumentUid
-      ) {
-        await add([
-          await this.candles.request(
-            userId,
-            revision,
-            {
-              uid: scope.instrumentUid,
-              instrumentType: scope.screen === 'bond' ? 'bond' : 'share',
-              period: scope.candlePeriod ?? 'month',
-              ...(scope.candleRange
-                ? {
-                    range: {
-                      from: new Date(scope.candleRange.from),
-                      to: new Date(scope.candleRange.to),
-                    },
-                  }
-                : {}),
-            },
-            now,
-            true,
-            FOREGROUND_CANDLE_PRIORITY,
-          ),
-        ]);
-      }
-      await this.repository.progress(attempt, children, true);
-    } catch {
-      await this.repository
-        .progress(attempt, children, true, TbankErrorCode.Unavailable)
-        .catch(() => undefined);
-    }
-  }
-
  async status(userId: string, id: string): Promise<TbankSyncStatusDto> {
    const connection = await this.access
      .local(userId)
@@ -3,9 +3,20 @@ import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';

 export const API_PREFIX = 'api/v1';

+// Nest Swagger cannot express additionalProperties on a class, so closed request
+// bodies are restored here after generation; the runtime allowlist stays in the controller.
+const CLOSED_SCHEMAS = ['StockScreenerCriteriaDto'];
+
 export function createOpenApiDocument(app: INestApplication) {
-  return SwaggerModule.createDocument(
+  const document = SwaggerModule.createDocument(
    app,
    new DocumentBuilder().setTitle('WealthLedger API').setVersion('v1').build(),
  );
+  const schemas = document.components?.schemas ?? {};
+  for (const [name, schema] of Object.entries(schemas)) {
+    if (CLOSED_SCHEMAS.includes(name) && 'properties' in schema) {
+      schema.additionalProperties = false;
+    }
+  }
+  return document;
 }
@@ -9,6 +9,7 @@ import { AppModule } from '../src/app.module';
 import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
 import { TbankClient } from '../src/integrations/tbank/tbank.client';
 import { configureApp } from '../src/main';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 describe('All accounts HTTP boundary', () => {
@@ -31,6 +32,8 @@ describe('All accounts HTTP boundary', () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(TbankClient)
      .useValue(upstream)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -2,7 +2,9 @@ import { INestApplication } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
 import { Test, TestingModule } from '@nestjs/testing';
+import * as bcrypt from 'bcrypt';
 import { PARAMS_PROVIDER_TOKEN } from 'nestjs-pino';
+import { createHash, randomUUID } from 'node:crypto';
 import request from 'supertest';
 import { App } from 'supertest/types';

@@ -10,6 +12,7 @@ import { AppModule } from '../src/app.module';
 import { loggingOptions } from '../src/common/logging/logging.module';
 import { configureApp } from '../src/main';
 import { AuthService } from '../src/modules/auth/application/auth.service';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 type Authentication = { accessToken: string; user: { email: string } };
@@ -33,7 +36,10 @@ describe('Authentication (e2e)', () => {
        },
        assignResponse: true,
      }),
-    }).compile();
+    })
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
+      .compile();

    app = moduleFixture.createNestApplication();
    configureApp(app);
@@ -90,6 +96,164 @@ describe('Authentication (e2e)', () => {
    await agent.post('/api/v1/auth/logout').expect(204);
  });

+  it('rejects a valid refresh token as Bearer while its session stays usable', async () => {
+    const registration = await request(app.getHttpServer())
+      .post('/api/v1/auth/register')
+      .send({ email: 'bearer@example.test', password: 'a secure password' })
+      .expect(200);
+    const cookie = registration.headers['set-cookie'][0];
+    const refreshToken = /^refresh_token=([^;]+)/.exec(cookie)?.[1];
+    if (!refreshToken) throw new Error('Expected a refresh token cookie');
+    // Signed, unexpired and backed by a live session: only its type is wrong.
+    await expect(app.get(JwtService).verifyAsync(refreshToken)).resolves.toMatchObject({
+      type: 'refresh',
+    });
+
+    await request(app.getHttpServer())
+      .get('/api/v1/auth/me')
+      .set('Authorization', `Bearer ${refreshToken}`)
+      .expect(401)
+      .expect(({ body }: { body: unknown }) =>
+        expect(body).toEqual({ status: 401, code: 'UNAUTHORIZED' }),
+      );
+
+    await request(app.getHttpServer())
+      .post('/api/v1/auth/refresh')
+      .set('Cookie', cookie)
+      .expect(200);
+  });
+
+  describe('refresh cookie policy', () => {
+    const attributes = (cookie: string) =>
+      cookie
+        .split('; ')
+        .slice(1)
+        .filter((attribute) => !attribute.startsWith('Expires='))
+        .sort((a, b) => a.localeCompare(b));
+    const host = ['HttpOnly', 'Path=/api/v1/auth', 'SameSite=Lax'];
+    const login = async () => {
+      const registration = await request(app.getHttpServer())
+        .post('/api/v1/auth/register')
+        .send({ email: 'cookie@example.test', password: 'a secure password' })
+        .expect(200);
+      return registration.headers['set-cookie'][0];
+    };
+
+    // The cookie policy reads NODE_ENV per request; the e2e runner defaults to development.
+    const inEnvironment = async <T>(nodeEnv: string, run: () => Promise<T>) => {
+      const previous = process.env['NODE_ENV'];
+      process.env['NODE_ENV'] = nodeEnv;
+      try {
+        return await run();
+      } finally {
+        process.env['NODE_ENV'] = previous;
+      }
+    };
+
+    it('issues, rotates and clears it HttpOnly, Lax, path-scoped, host-only and Secure in production', async () => {
+      await inEnvironment('production', async () => {
+        const issued = await login();
+        const rotated = await request(app.getHttpServer())
+          .post('/api/v1/auth/refresh')
+          .set('Cookie', issued)
+          .expect(200);
+        const cleared = await request(app.getHttpServer())
+          .post('/api/v1/auth/logout')
+          .set('Cookie', rotated.headers['set-cookie'][0])
+          .expect(204);
+
+        // Exact set: any added Domain/Max-Age or a dropped flag fails.
+        for (const cookie of [issued, rotated.headers['set-cookie'][0], cleared.headers['set-cookie'][0]]) {
+          expect(attributes(cookie)).toEqual([...host, 'Secure'].sort((a, b) => a.localeCompare(b)));
+        }
+      });
+    });
+
+    it('drops only Secure in development and keeps every other attribute', async () => {
+      await inEnvironment('development', async () => {
+        expect(attributes(await login())).toEqual(host);
+      });
+    });
+  });
+
+  describe('expired credentials', () => {
+    const sha256 = (token: string) => createHash('sha256').update(token).digest('hex');
+    const PAST = () => Math.floor(Date.now() / 1000) - 60;
+    const FUTURE = () => Math.floor(Date.now() / 1000) + 600;
+    const register = async () => {
+      const registration = await request(app.getHttpServer())
+        .post('/api/v1/auth/register')
+        .send({ email: 'expiry@example.test', password: 'a secure password' })
+        .expect(200);
+      const session = await app.get(PrismaService).session.findFirstOrThrow();
+      return {
+        cookie: registration.headers['set-cookie'][0],
+        sub: session.userId,
+        sid: session.id,
+      };
+    };
+
+    it('rejects a signed expired access token but admits the same claims unexpired', async () => {
+      const { sub, sid } = await register();
+      const jwt = app.get(JwtService);
+      const expired = await jwt.signAsync({ sub, sid, type: 'access', exp: PAST() });
+      const fresh = await jwt.signAsync({ sub, sid, type: 'access', exp: FUTURE() });
+
+      await request(app.getHttpServer())
+        .get('/api/v1/auth/me')
+        .set('Authorization', `Bearer ${expired}`)
+        .expect(401);
+      await request(app.getHttpServer())
+        .get('/api/v1/auth/me')
+        .set('Authorization', `Bearer ${fresh}`)
+        .expect(200)
+        .expect(({ body }: { body: unknown }) =>
+          expect((body as { email: string }).email).toBe('expiry@example.test'),
+        );
+    });
+
+    it('rejects a signed expired refresh token that matches the live session hash', async () => {
+      const { sub, sid } = await register();
+      const jwt = app.get(JwtService);
+      const prisma = app.get(PrismaService);
+      const claims = { sub, sid, type: 'refresh' };
+      const expired = await jwt.signAsync({ ...claims, jti: randomUUID(), exp: PAST() });
+      const fresh = await jwt.signAsync({ ...claims, jti: randomUUID(), exp: FUTURE() });
+
+      // Hash, session and signature all valid: only `exp` differs between the two.
+      await prisma.session.update({ where: { id: sid }, data: { refreshTokenHash: sha256(expired) } });
+      const rejected = await request(app.getHttpServer())
+        .post('/api/v1/auth/refresh')
+        .set('Cookie', `refresh_token=${expired}`)
+        .expect(401);
+      expect(rejected.headers['set-cookie']).toBeUndefined();
+
+      await prisma.session.update({ where: { id: sid }, data: { refreshTokenHash: sha256(fresh) } });
+      await request(app.getHttpServer())
+        .post('/api/v1/auth/refresh')
+        .set('Cookie', `refresh_token=${fresh}`)
+        .expect(200);
+    });
+
+    it('rejects a valid refresh token once its session is DB-expired', async () => {
+      const { cookie, sid } = await register();
+      const prisma = app.get(PrismaService);
+      await prisma.session.update({ where: { id: sid }, data: { expiresAt: new Date(Date.now() - 1000) } });
+
+      const rejected = await request(app.getHttpServer())
+        .post('/api/v1/auth/refresh')
+        .set('Cookie', cookie)
+        .expect(401);
+
+      expect(rejected.headers['set-cookie']).toBeUndefined();
+      expect(await prisma.session.count()).toBe(0);
+      await request(app.getHttpServer())
+        .post('/api/v1/auth/refresh')
+        .set('Cookie', cookie)
+        .expect(401);
+    });
+  });
+
  it('keeps logout idempotent for an invalid refresh token', async () => {
    const logout = await request(app.getHttpServer())
      .post('/api/v1/auth/logout')
@@ -261,6 +425,45 @@ describe('Authentication (e2e)', () => {
    expect(await app.get(PrismaService).user.count()).toBe(0);
  });

+  it('applies the ASCII 8..72 password policy on register and keeps login lenient', async () => {
+    const validation = (detail: string) => ({
+      status: 400,
+      code: 'VALIDATION_ERROR',
+      errors: [{ pointer: '#/password', detail }],
+    });
+    for (const [index, password] of ['a'.repeat(8), ' '.repeat(2) + 'b'.repeat(70)].entries()) {
+      const credentials = { email: `user${index}@example.com`, password };
+      await request(app.getHttpServer()).post('/api/v1/auth/register').send(credentials).expect(200);
+      await request(app.getHttpServer()).post('/api/v1/auth/login').send(credentials).expect(200);
+    }
+    for (const password of ['a'.repeat(7), 'a'.repeat(73), 'пароль-пароль', 'passw😀rd', 'pass\tword1']) {
+      await request(app.getHttpServer())
+        .post('/api/v1/auth/register')
+        .send({ email: 'rejected@example.com', password })
+        .expect(400)
+        .expect('Content-Type', /application\/problem\+json/)
+        .expect(({ body }: { body: unknown }) =>
+          expect(body).toEqual(validation('must be 8-72 printable ASCII characters')),
+        );
+    }
+    expect(await app.get(PrismaService).user.count()).toBe(2);
+
+    // An account created under the previous policy (Cyrillic, 12+ chars) must still log in.
+    const legacy = { email: 'legacy@example.com', password: 'пароль-пароль' };
+    const prisma = app.get(PrismaService);
+    await prisma.user.create({
+      data: { id: randomUUID(), email: legacy.email, passwordHash: await bcrypt.hash(legacy.password, 4) },
+    });
+    await request(app.getHttpServer()).post('/api/v1/auth/login').send(legacy).expect(200);
+    await request(app.getHttpServer())
+      .post('/api/v1/auth/login')
+      .send({ email: legacy.email, password: 'a'.repeat(73) })
+      .expect(400)
+      .expect(({ body }: { body: unknown }) =>
+        expect(body).toEqual(validation('must not exceed 72 UTF-8 bytes')),
+      );
+  });
+
  it('guards T-Bank connection and never returns a token', async () => {
    const registration = await request(app.getHttpServer())
      .post('/api/v1/auth/register')
@@ -16,6 +16,7 @@ import {
  BankSummaryDto,
  ExpenseCategoryDto,
 } from '../src/modules/banking/bank-cards/presentation/bank-card.dto';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 jest.setTimeout(60000);
@@ -77,7 +78,10 @@ describe('Manual bank cards configured HTTP and real SQLite', () => {
  const start = async () => {
    const module = await Test.createTestingModule({
      imports: [AppModule],
-    }).compile();
+    })
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
+      .compile();
    app = module.createNestApplication();
    configureApp(app);
    await app.listen(0, '127.0.0.1');
@@ -369,6 +373,8 @@ describe('Manual bank cards configured HTTP and real SQLite', () => {
    expect((await getCard(own.id)).balance.value).toBe('1000');
  });
  it('renames default category without role loss; duplicates and stale rename conflict', async () => {
+    // Defaults are seeded by the first write of the user; this case must not depend on earlier cases.
+    await createCard();
    const category = (await categories()).find((c) => c.isDefault);
    assert.ok(category);
    await auth('patch', '/categories/' + category.id)
@@ -725,11 +731,19 @@ describe('Manual bank cards configured HTTP and real SQLite', () => {
    expect(await getCard(card.id)).toEqual(before);
    expect((await getOp(refund.id)).originalExpenseId).toBe(purchase.id);
    await auth('post', '/operations').send(deletedBody).expect(410);
+    // The rename is this case's own prerequisite, not an effect of an earlier case.
+    const defaultCategory = (await categories()).find((c) => c.isDefault);
+    assert.ok(defaultCategory);
+    await auth('patch', '/categories/' + defaultCategory.id)
+      .send({ version: defaultCategory.version, name: 'Остальное' })
+      .expect(200);
    expect((await categories()).find((c) => c.isDefault)?.name).toBe(
      'Остальное',
    );
  });
  it('enforces actual FK and unique constraints', async () => {
+    // Seeds the owner's default categories so the unique-name check has a real row to collide with.
+    await createCard();
    await expect(
      db.expenseCategory.create({
        data: {
@@ -1,5 +1,6 @@
 import type { Server } from 'node:http';

+import { status } from '@grpc/grpc-js';
 import {
  ConflictException,
  INestApplication,
@@ -15,6 +16,14 @@ import { configureApp } from '../src/main';
 import { BondCatalogService } from '../src/modules/investments/instruments/bonds/application/bond-catalog.service';
 import { BondIncomeService } from '../src/modules/investments/instruments/bonds/application/bond-income.service';
 import { BondMarketService } from '../src/modules/investments/instruments/bonds/application/bond-market.service';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
+import {
+  bootOnlineApp,
+  expectSafeBody,
+  failUpstream,
+  onlineUserId,
+  refusals,
+} from './online-upstream';

 const uid = 'e6123145-9665-43e0-8413-cd61b8aa9b13';
 describe('Bond HTTP contract', () => {
@@ -38,6 +47,8 @@ describe('Bond HTTP contract', () => {
      .useValue(bonds)
      .overrideProvider(BondIncomeService)
      .useValue(bonds)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -198,3 +209,39 @@ describe('Bond HTTP contract', () => {
    expect(response.body).not.toHaveProperty('stack');
  });
 });
+
+// Real services and TbankClient error mapping; only the gRPC transport is stubbed.
+// Bonds expose no company or screener route; their online entrypoints are search, detail and ticker.
+describe('Bond online reads: upstream failure translation', () => {
+  const rpc = jest.fn();
+  let ctx: Awaited<ReturnType<typeof bootOnlineApp>>;
+  const get = (path: string) => request(ctx.app.getHttpServer()).get(path);
+  // [entrypoint, request, RPC that fails second]: a failure after the first call must translate too.
+  const entrypoints: [string, () => request.Test, string][] = [
+    ['search', () => get('/api/v1/bonds?query=SBER'), 'getLastPrices'],
+    ['detail', () => get(`/api/v1/bonds/${uid}`), 'bondBy'],
+    ['ticker', () => get('/api/v1/bonds/by-ticker/SBER'), 'bondBy'],
+  ];
+  const cases = entrypoints.flatMap(([name, send, later]) =>
+    refusals.flatMap((code) => [undefined, later].map((at) => [name, code, at, send] as const)),
+  );
+
+  beforeAll(async () => {
+    ctx = await bootOnlineApp(rpc);
+  });
+  afterAll(() => ctx.app.close());
+
+  it.each(cases)('%s: upstream auth refusal %s (failing RPC %s) becomes 400/INVALID_TBANK_TOKEN', async (_name, code, at, send) => {
+    failUpstream(rpc, 'bond', code, at);
+    const response = await send().set('Authorization', ctx.bearer).expect(400);
+    expectSafeBody(response.body, 400, 'INVALID_TBANK_TOKEN');
+    const saved = await ctx.prisma.tbankConnection.findUniqueOrThrow({ where: { userId: onlineUserId } });
+    expect(saved).toMatchObject({ invalidToken: false, revision: ctx.connection.revision });
+  });
+
+  it.each(entrypoints)('%s: temporary unavailability stays 503/TBANK_UNAVAILABLE', async (_name, send) => {
+    failUpstream(rpc, 'bond', status.UNAVAILABLE);
+    const response = await send().set('Authorization', ctx.bearer).expect(503);
+    expectSafeBody(response.body, 503, 'TBANK_UNAVAILABLE');
+  });
+});
@@ -0,0 +1,87 @@
+import type { Server } from 'node:http';
+
+import { status } from '@grpc/grpc-js';
+import { INestApplication } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { Test } from '@nestjs/testing';
+
+import { AppModule } from '../src/app.module';
+import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
+import { TbankClient } from '../src/integrations/tbank/tbank.client';
+import { configureApp } from '../src/main';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
+import { PrismaService } from '../src/prisma/prisma.service';
+
+export const onlineUserId = 'online-reader';
+export const onlineToken = 'synthetic-online-token';
+export const rawUpstreamText = 'raw upstream refusal text';
+export const refusals = [status.UNAUTHENTICATED, status.PERMISSION_DENIED];
+
+// Real TbankClient with only the transport stubbed: the gRPC status goes through its real error mapping.
+export async function bootOnlineApp(rpc: jest.Mock) {
+  const upstream = Object.assign(Object.create(TbankClient.prototype) as TbankClient, {
+    logger: { event: jest.fn() },
+    queue: { run: (operation: () => Promise<unknown>) => operation(), size: 0 },
+    request: rpc,
+  });
+  const module = await Test.createTestingModule({ imports: [AppModule] })
+    .overrideProvider(TbankClient)
+    .useValue(upstream)
+    .overrideProvider(TbankHourlyScheduler)
+    .useValue({ tick: jest.fn() })
+    .compile();
+  const app: INestApplication<Server> = module.createNestApplication();
+  configureApp(app);
+  await app.init();
+  await app.listen(0, '127.0.0.1');
+  const prisma = app.get(PrismaService);
+  await prisma.user.create({
+    data: { id: onlineUserId, email: 'online@example.invalid', passwordHash: 'synthetic' },
+  });
+  const connection = await prisma.tbankConnection.create({
+    data: {
+      userId: onlineUserId,
+      encryptedToken: app.get(TbankTokenService).encrypt(onlineToken),
+      connectedAt: new Date(),
+    },
+  });
+  const bearer = `Bearer ${new JwtService().sign(
+    { sub: onlineUserId, type: 'access' },
+    { secret: process.env.JWT_SECRET },
+  )}`;
+  return { app, bearer, connection, prisma };
+}
+
+// Healthy answers for every RPC an online entrypoint uses; `at` picks the single RPC that fails.
+export function failUpstream(rpc: jest.Mock, kind: 'bond' | 'share', code: number, at?: string) {
+  const instrument = {
+    apiTradeAvailableFlag: true,
+    assetUid: 'asset-uid',
+    instrumentKind: kind === 'bond' ? 'INSTRUMENT_TYPE_BOND' : 'INSTRUMENT_TYPE_SHARE',
+    ticker: 'SBER',
+    uid: 'e6123145-9665-43e0-8413-cd61b8aa9b13',
+  };
+  const healthy = new Map<string, unknown>([
+    ['bondBy', { instrument }],
+    ['findInstrument', { instruments: [instrument] }],
+    ['getAssetBy', { asset: { description: 'description' } }],
+    ['getAssetFundamentals', { fundamentals: [] }],
+    ['getLastPrices', { lastPrices: [] }],
+    ['shareBy', { instrument }],
+  ]);
+  const failure = Object.assign(new Error('grpc failure'), {
+    code,
+    details: `${rawUpstreamText} Bearer ${onlineToken}`,
+  });
+  rpc.mockReset();
+  rpc.mockImplementation((_token: string, _client: unknown, method: string) =>
+    !at || method === at ? Promise.reject(failure) : Promise.resolve(healthy.get(method) ?? {}),
+  );
+}
+
+// Safe public error: stable code only, no upstream text, no credentials.
+export function expectSafeBody(body: unknown, status: number, code: string) {
+  expect(body).toEqual({ code, status });
+  expect(JSON.stringify(body)).not.toContain(rawUpstreamText);
+  expect(JSON.stringify(body)).not.toContain(onlineToken);
+}
@@ -122,6 +122,13 @@ describe('OpenAPI contract (integration)', () => {
  });

  it('generates the runtime contract without server startup or deployment configuration', async () => {
+    const schemas = createOpenApiDocument(app).components?.schemas;
+    expect(schemas?.StockScreenerCriteriaDto).toMatchObject({
+      additionalProperties: false,
+    });
+    expect(schemas?.StockScreenerItemDto).toMatchObject({
+      properties: { lot: { type: 'integer', minimum: 1, nullable: true } },
+    });
    expect(
      createOpenApiDocument(app).components?.schemas?.ProblemDetailsDto,
    ).toMatchObject({
@@ -18,7 +18,7 @@ writeFileSync(sentinel, 'fictional user database: must never be opened');
 const before = readFileSync(sentinel);
 const databases = new Set();
 async function check(name, overrides = {}, signal) {
-  const child = spawn(process.execPath, ['test/sqlite.cjs', '--all'], {
+  const child = spawn(process.execPath, ['test/sqlite.cjs'], {
    cwd,
    env: {
      ...process.env,
@@ -1,5 +1,6 @@
 import type { Server } from 'node:http';

+import { status } from '@grpc/grpc-js';
 import {
  ConflictException,
  INestApplication,
@@ -16,6 +17,14 @@ import { StockCatalogService } from '../src/modules/investments/instruments/stoc
 import { StockIncomeService } from '../src/modules/investments/instruments/stocks/application/stock-income.service';
 import { StockMarketService } from '../src/modules/investments/instruments/stocks/application/stock-market.service';
 import { StockScreenerService } from '../src/modules/investments/instruments/stocks/application/stock-screener.service';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
+import {
+  bootOnlineApp,
+  expectSafeBody,
+  failUpstream,
+  onlineUserId,
+  refusals,
+} from './online-upstream';

 const uid = 'e6123145-9665-43e0-8413-cd61b8aa9b13';
 describe('Stock HTTP contract', () => {
@@ -41,6 +50,8 @@ describe('Stock HTTP contract', () => {
      .useValue(stocks)
      .overrideProvider(StockScreenerService)
      .useValue(screener)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -198,3 +209,40 @@ describe('Stock HTTP contract', () => {
    expect(response.body).not.toHaveProperty('stack');
  });
 });
+
+// Real services and TbankClient error mapping; only the gRPC transport is stubbed.
+describe('Stock online reads: upstream failure translation', () => {
+  const rpc = jest.fn();
+  let ctx: Awaited<ReturnType<typeof bootOnlineApp>>;
+  const get = (path: string) => request(ctx.app.getHttpServer()).get(path);
+  // [entrypoint, request, RPC that fails second]: a failure after the first call must translate too.
+  const entrypoints: [string, () => request.Test, string][] = [
+    ['search', () => get('/api/v1/stocks?query=SBER'), 'getLastPrices'],
+    ['detail', () => get(`/api/v1/stocks/${uid}`), 'shareBy'],
+    ['ticker', () => get('/api/v1/stocks/by-ticker/SBER'), 'shareBy'],
+    ['company', () => get(`/api/v1/stocks/${uid}/company`), 'getAssetBy'],
+    ['screener', () => request(ctx.app.getHttpServer()).post('/api/v1/stocks/screener/search').send({}), 'shares'],
+  ];
+  const cases = entrypoints.flatMap(([name, send, later]) =>
+    refusals.flatMap((code) => [undefined, later].map((at) => [name, code, at, send] as const)),
+  );
+
+  beforeAll(async () => {
+    ctx = await bootOnlineApp(rpc);
+  });
+  afterAll(() => ctx.app.close());
+
+  it.each(cases)('%s: upstream auth refusal %s (failing RPC %s) becomes 400/INVALID_TBANK_TOKEN', async (_name, code, at, send) => {
+    failUpstream(rpc, 'share', code, at);
+    const response = await send().set('Authorization', ctx.bearer).expect(400);
+    expectSafeBody(response.body, 400, 'INVALID_TBANK_TOKEN');
+    const saved = await ctx.prisma.tbankConnection.findUniqueOrThrow({ where: { userId: onlineUserId } });
+    expect(saved).toMatchObject({ invalidToken: false, revision: ctx.connection.revision });
+  });
+
+  it.each(entrypoints)('%s: temporary unavailability stays 503/TBANK_UNAVAILABLE', async (_name, send) => {
+    failUpstream(rpc, 'share', status.UNAVAILABLE);
+    const response = await send().set('Authorization', ctx.bearer).expect(503);
+    expectSafeBody(response.body, 503, 'TBANK_UNAVAILABLE');
+  });
+});
@@ -1,6 +1,5 @@
 import { ConfigService } from '@nestjs/config';
 import assert from 'node:assert/strict';
-import { setTimeout as delay } from 'node:timers/promises';

 import { TbankAccessService } from '../src/integrations/tbank/tbank-access.service';
 import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
@@ -12,7 +11,7 @@ import {
 } from '../src/modules/investments/instruments/infrastructure/catalog-discovery.repository';
 import { PrismaService } from '../src/prisma/prisma.service';

-// Real transactions prove query coverage, private work ownership and late-publication fences.
+// Real transactions prove query normalization, confirmed-empty identity and cross-user isolation of shared reads.
 describe('shared catalog discovery (SQLite)', () => {
  const prisma = new PrismaService(
    new ConfigService({ DATABASE_URL: process.env.DATABASE_URL }),
@@ -30,7 +29,6 @@ describe('shared catalog discovery (SQLite)', () => {
      repository,
      access,
      upstream as never,
-      { event: jest.fn() } as never,
      { requestMany: jest.fn().mockResolvedValue([]) } as never,
    );
  let service: CatalogDiscoveryService;
@@ -51,14 +49,42 @@ describe('shared catalog discovery (SQLite)', () => {
        connectedAt: new Date(),
      },
    });
-  async function settled() {
-    for (let i = 0; i < 300; i++) {
-      if (!(await prisma.tbankSyncWork.count({ where: { state: 'running' } }))) {
-        return;
-      }
-      await delay(5);
+  // Writes a finished discovery directly, so the read path is tested without any producer.
+  async function seedCatalog(
+    query: string,
+    instruments: Array<{ payload: CatalogInstrument; uid: string }>,
+  ) {
+    for (const item of instruments) {
+      await prisma.tbankInstrument.create({
+        data: {
+          provider: 'tbank',
+          uid: item.uid,
+          instrumentType: 'share',
+          metadata: {},
+          fetchedAt: new Date(),
+        },
+      });
+      await prisma.tbankInstrumentSource.create({
+        data: {
+          provider: 'tbank',
+          instrumentUid: item.uid,
+          source: 'tbank',
+          kind: 'catalog',
+          rangeKey: 'share',
+          payload: item.payload,
+          fetchedAt: new Date(),
+        },
+      });
    }
-    throw new Error('Catalog work did not settle');
+    await prisma.tbankCatalogDiscovery.create({
+      data: {
+        provider: 'tbank',
+        instrumentType: 'share',
+        query,
+        instrumentUids: instruments.map((item) => item.uid),
+        fetchedAt: new Date(),
+      },
+    });
  }
  beforeAll(async () => {
    await prisma.$connect();
@@ -72,265 +98,41 @@ describe('shared catalog discovery (SQLite)', () => {
  beforeEach(async () => {
    await prisma.tbankConnection.deleteMany();
    await prisma.tbankCatalogDiscovery.deleteMany();
+    await prisma.tbankInstrumentSource.deleteMany();
    await prisma.tbankInstrument.deleteMany();
    await seed('owner');
    await seed('other');
    jest.resetAllMocks();
-    upstream.findShares.mockResolvedValue([instrument]);
-    upstream.findBonds.mockResolvedValue([
-      { ...instrument, uid: 'bond', instrumentKind: 'INSTRUMENT_TYPE_BOND' },
-    ]);
    service = createService();
  });
-  it('persists normalized query identity and confirmed empty separately from unknown, across users and reopen', async () => {
+  it('treats an unknown query as unavailable and a seeded query as available for another user', async () => {
    const cold = await service.read('owner', { ...query, query: ' sber ' });
    expect(cold.data).toBeNull();
-    expect(cold.meta.availability).toBe('initial-loading');
-    await settled();
-    await prisma.$disconnect();
-    service = createService();
-    const decrypt = jest.spyOn(tokens, 'decrypt');
+    expect(cold.meta.availability).toBe('temporarily-unavailable');
+    await seedCatalog('SBER', [{ uid: 'uid', payload: instrument }]);
    const warm = await service.read('other', query);
    expect(warm.data).toEqual([instrument]);
    expect(warm.meta.availability).toBe('available');
-    expect(warm.meta.completeness).toBe('complete');
-    expect(warm.meta.sync.id).toBeNull();
-    expect(decrypt).not.toHaveBeenCalled();
-    expect(upstream.findShares).toHaveBeenCalledTimes(1);
-    expect(
-      (await service.read('other', { ...query, query: 'GAZP' }, true)).data,
-    ).toBeNull();
-    upstream.findShares.mockResolvedValue([]);
-    await service.read('other', { ...query, query: 'GAZP' });
-    await settled();
-    expect(
-      (await service.read('owner', { ...query, query: 'GAZP' })).data,
-    ).toEqual([]);
-    expect((await service.read('owner', query)).data).toEqual([instrument]);
-    expect(upstream.findShares).toHaveBeenCalledTimes(2);
-    decrypt.mockRestore();
-    await service.read('owner', { ...query, instrumentType: 'bond' });
-    await settled();
-    expect(
-      (await service.read('other', { ...query, instrumentType: 'bond' }))
-        .data?.[0].uid,
-    ).toBe('bond');
-  });
-  it('keeps selection ordering, deduplicates before limiting, and retains identity without enrichment or private fields', async () => {
-    upstream.findShares.mockResolvedValue([
-      { ...instrument, uid: 'unavailable', apiTradeAvailableFlag: false },
-      {
-        ...instrument,
-        uid: 'preferred',
-        apiTradeAvailableFlag: true,
-        classCode: 'TQBR',
-        quantity: '999',
-        estimatedAmount: 'secret',
-      },
-      ...Array.from({ length: 40 }, (_, i) => ({
-        ...instrument,
-        uid: `other-${String(i).padStart(2, '0')}`,
-        isin: undefined,
-        ticker: 'OTHER',
-      })),
-      {
-        ...instrument,
-        uid: 'wrong-kind',
-        instrumentKind: 'INSTRUMENT_TYPE_BOND',
-      },
-    ]);
-    await service.read('owner', query);
-    await settled();
-    const saved = await service.read('other', query);
-    expect(saved.data).toHaveLength(30);
-    expect(saved.data?.[0].uid).toBe('preferred');
-    expect(
-      saved.data?.some((row) =>
-        ['unavailable', 'wrong-kind'].includes(row.uid),
-      ),
-    ).toBe(false);
-    expect(
-      JSON.stringify(await prisma.tbankInstrumentSource.findMany()),
-    ).not.toMatch(
-      /quantity|estimatedAmount|secret|owner-revision|synthetic-owner/,
-    );
-    expect(await prisma.tbankInstrumentLookup.count()).toBe(0);
-  });
-  it('does not overwrite detailed metadata or its timestamp while refreshing discovery', async () => {
-    const detailed = { ...instrument, sector: 'financial', lot: 10 };
-    const fetchedAt = new Date('2026-01-01');
-    await prisma.tbankInstrument.create({
-      data: {
-        provider: 'tbank',
-        uid: 'uid',
-        instrumentType: 'share',
-        metadata: detailed,
-        fetchedAt,
-      },
-    });
-    await service.read('owner', query);
-    await settled();
-    const row = await prisma.tbankInstrument.findUniqueOrThrow({
-      where: { provider_uid: { provider: 'tbank', uid: 'uid' } },
-    });
-    expect(row.metadata).toEqual(detailed);
-    expect(row.fetchedAt).toEqual(fetchedAt);
-  });
-  it('coalesces twenty concurrent requests and forces with private handles and one upstream call', async () => {
-    const blocked = deferred<CatalogInstrument[]>();
-    upstream.findShares.mockReturnValue(blocked.promise);
-    const reads = await Promise.all(
-      Array.from({ length: 20 }, (_, i) =>
-        service.read(i % 2 ? 'owner' : 'other', query),
-      ),
-    );
-    await service.request('owner', 'owner-revision', query, true);
-    await delay(10);
-    expect(upstream.findShares).toHaveBeenCalledTimes(1);
-    expect(new Set(reads.map((read) => read.meta.sync.id)).size).toBe(2);
-    blocked.resolve([instrument]);
-    await settled();
-    expect(
-      await prisma.tbankSyncWork.count({ where: { state: 'complete' } }),
-    ).toBe(2);
-  });
-  it.each(['delete', 'replace'])(
-    'discards late %s publication and does not borrow observer credentials',
-    async (action) => {
-      const blocked = deferred<CatalogInstrument[]>();
-      upstream.findShares.mockReturnValueOnce(blocked.promise);
-      await service.read('owner', query);
-      await service.read('other', query);
-      await delay(10);
-      await prisma.tbankConnection.delete({ where: { userId: 'owner' } });
-      if (action === 'replace') {
-        await prisma.tbankConnection.create({
-          data: {
-            userId: 'owner',
-            revision: 'replacement',
-            encryptedToken: tokens.encrypt('replacement'),
-            connectedAt: new Date(),
-          },
-        });
-      }
-      blocked.resolve([instrument]);
-      await settled();
-      expect(await prisma.tbankCatalogDiscovery.count()).toBe(0);
-      expect(await prisma.tbankInstrument.count()).toBe(0);
-      expect(
-        (await service.read('other', query, true)).meta.sync.errorCode,
-      ).toBe('TBANK_UNAVAILABLE');
-      expect(upstream.findShares).toHaveBeenCalledTimes(1);
-      await service.read('other', query);
-      await settled();
-      expect((await service.read('other', query, true)).data).toEqual([
-        instrument,
-      ]);
-    },
-  );
-  it('preserves a successful result and its timestamp after a failed force without observe retry', async () => {
-    await service.read('owner', query);
-    await settled();
-    const before = await repository.read(query);
-    upstream.findShares.mockRejectedValue(new Error('outage'));
-    await service.request('owner', 'owner-revision', query, true);
-    await settled();
-    for (let i = 0; i < 5; i++) await service.read('owner', query, true);
-    expect(await repository.read(query)).toEqual(before);
-    expect((await service.read('owner', query, true)).meta.sync.state).toBe(
-      'failed',
-    );
-    expect(upstream.findShares).toHaveBeenCalledTimes(2);
-    expect((await service.read('other', query)).meta.sync.errorCode).toBeNull();
-  });
-  it('isolates invalid credentials from shared empty lookup and another user', async () => {
-    const blocked = deferred<CatalogInstrument[]>();
-    upstream.findShares.mockReturnValueOnce(blocked.promise);
-    await service.read('owner', query);
-    await service.read('other', query);
-    blocked.reject(new Error('INVALID_TBANK_TOKEN'));
-    await settled();
-    expect(await prisma.tbankCatalogDiscovery.count()).toBe(0);
-    expect(
-      (
-        await prisma.tbankConnection.findUniqueOrThrow({
-          where: { userId: 'owner' },
-        })
-      ).invalidToken,
-    ).toBe(true);
-    expect((await service.read('other', query, true)).meta.sync.errorCode).toBe(
-      'TBANK_UNAVAILABLE',
-    );
-    await service.read('other', query);
-    await settled();
-    expect((await service.read('other', query, true)).data).toEqual([
-      instrument,
-    ]);
-  });
-  it('recovers abandoned work only on the next ordinary request and rejects superseded attempts', async () => {
-    const abandoned = await repository.reserve(
-      { userId: 'owner', revision: 'owner-revision' },
-      query,
-      'old-process',
-      new Set(),
-    );
-    assert(abandoned);
-    service = createService();
-    await service.read('owner', query, true);
-    await delay(10);
    expect(upstream.findShares).not.toHaveBeenCalled();
-    await service.read('owner', query);
-    await settled();
-    expect(
-      await repository.publish(
-        {
-          userId: 'owner',
-          revision: 'owner-revision',
-          id: abandoned.work.id,
-          attemptId: abandoned.work.attemptId,
-        },
-        query,
-        [],
-        new Date(),
-      ),
-    ).toBe(false);
-    expect((await service.read('owner', query, true)).data).toEqual([
-      instrument,
-    ]);
  });
-  it('keeps known discovery stable between refresh requests', async () => {
-    await service.read('owner', query);
-    await settled();
-    const now = Date.now();
-    const clock = jest.spyOn(Date, 'now').mockReturnValue(now);
-    try {
-      await prisma.tbankCatalogDiscovery.updateMany({
-        data: { fetchedAt: new Date(now - 86_399_000) },
-      });
-      await service.read('other', query);
-      expect(upstream.findShares).toHaveBeenCalledTimes(1);
-      await prisma.tbankCatalogDiscovery.updateMany({
-        data: { fetchedAt: new Date(now - 86_400_000) },
-      });
-      expect((await service.read('other', query, true)).meta.freshness).toBe('fresh');
-      expect(upstream.findShares).toHaveBeenCalledTimes(1);
-      await service.read('other', query);
-      expect(upstream.findShares).toHaveBeenCalledTimes(1);
-    } finally {
-      clock.mockRestore();
-    }
+  it('keeps a confirmed empty result distinct from an unknown query', async () => {
+    await seedCatalog('GAZP', []);
+    const empty = await service.read('owner', { ...query, query: 'GAZP' });
+    expect(empty.data).toEqual([]);
+    expect(empty.meta.availability).toBe('available');
+    const unknown = await service.read('owner', { ...query, query: 'LKOH' });
+    expect(unknown.data).toBeNull();
+  });
+  it('keeps the stored selection order and does not expose private fields', async () => {
+    const first = { ...instrument, uid: 'first', name: 'First' };
+    const second = { ...instrument, uid: 'second', name: 'Second' };
+    await seedCatalog('SBER', [
+      { uid: 'second', payload: second },
+      { uid: 'first', payload: first },
+    ]);
+    const result = await service.read('owner', query);
+    assert(result.data);
+    expect(result.data.map((item) => item.uid)).toEqual(['second', 'first']);
+    expect(result.data[0]).not.toHaveProperty('accountId');
  });
 });
-function deferred<T>() {
-  let resolve: (value: T) => void = () => {
-    throw new Error('Uninitialized deferred');
-  };
-  let reject: (error: Error) => void = () => {
-    throw new Error('Uninitialized deferred');
-  };
-  const promise = new Promise<T>((yes, no) => {
-    resolve = yes;
-    reject = no;
-  });
-  return { promise, resolve, reject };
-}
@@ -10,6 +10,7 @@ import { TbankAccessService } from '../src/integrations/tbank/tbank-access.servi
 import { TbankTokenService } from '../src/integrations/tbank/tbank-token.service';
 import { TbankClient } from '../src/integrations/tbank/tbank.client';
 import { configureApp } from '../src/main';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 describe('Persistent T-Bank connection boundary (SQLite/HTTP)', () => {
@@ -31,6 +32,8 @@ describe('Persistent T-Bank connection boundary (SQLite/HTTP)', () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(TbankClient)
      .useValue(upstream)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -385,6 +385,83 @@ describe('hourly attempt lifecycle (SQLite)', () => {
    expect(next?.state).not.toBe('running');
  });

+  describe('hourly term eligibility', () => {
+    const at = (h: number, m = 0) => new Date(Date.UTC(2026, 0, 1, h, m));
+    const seed = (
+      state: 'complete' | 'failed' | 'running',
+      start: Date,
+      end: Date,
+      processRunId = 'other-process',
+    ) =>
+      prisma.tbankSyncWork.create({
+        data: {
+          id: randomUUID(),
+          userId: USER,
+          revision: REVISION,
+          scopeKey: 'hourly',
+          attemptId: randomUUID(),
+          processRunId,
+          priority: 0,
+          intent: {},
+          progress: {},
+          state,
+          createdAt: start,
+          updatedAt: end,
+        },
+      });
+    const reserve = async (when: Date) => {
+      jest.setSystemTime(when);
+      return repository.reserveHourly(USER, 'this-process', 3_600_000);
+    };
+
+    it.each([
+      ['short attempt', 'complete', at(10), at(10, 5), at(10, 59), at(11)],
+      ['failed attempt', 'failed', at(10), at(10, 5), at(10, 59), at(11)],
+      ['walk past one term', 'complete', at(10), at(11, 10), at(11, 59), at(12)],
+      ['walk past two terms', 'complete', at(10), at(12, 10), at(12, 59), at(13)],
+      ['walk ending on a term', 'complete', at(10), at(11), at(10, 59), at(11)],
+    ] as const)('%s', async (_name, state, start, end, early, due) => {
+      await seed(state, start, end);
+      expect(await reserve(early)).toBeNull();
+      const reserved = await reserve(due);
+      expect(reserved?.work.state).toBe('running');
+      expect(reserved?.work.createdAt).toEqual(due);
+    });
+
+    it('starts a new revision at once', async () => {
+      await seed('complete', at(10), at(10, 5));
+      await prisma.tbankConnection.deleteMany({ where: { userId: USER } });
+      await prisma.tbankConnection.create({
+        data: {
+          userId: USER,
+          revision: 'next-revision',
+          encryptedToken: tokens.encrypt('synthetic'),
+          connectedAt: at(10, 10),
+        },
+      });
+      expect((await reserve(at(10, 10)))?.work.revision).toBe('next-revision');
+    });
+
+    it('closes a dead process attempt without early retry and runs one catch-up after downtime', async () => {
+      await seed('running', at(10), at(10, 1), 'dead-process');
+      expect(await reserve(at(10, 30))).toBeNull();
+      expect((await hourlyRow())?.errorCode).toBe('INTERRUPTED');
+      expect(await reserve(at(10, 59))).toBeNull();
+      expect((await reserve(at(14, 30)))?.work.createdAt).toEqual(at(14, 30));
+      expect(await reserve(at(14, 31))).toBeNull();
+      expect(
+        await prisma.tbankSyncWork.count({
+          where: { userId: USER, scopeKey: 'hourly' },
+        }),
+      ).toBe(1);
+    });
+
+    it('does not reserve while this process still runs the attempt', async () => {
+      await seed('running', at(10), at(10, 1), 'this-process');
+      expect(await reserve(at(12, 30))).toBeNull();
+    });
+  });
+
  it('does not overlap a running attempt with a second walk', async () => {
    operations.request.mockImplementation(async () => {
      const row = await child('running', null, 'operations');
@@ -15,6 +15,7 @@ import {
 } from '../src/modules/investments/income/income-analytics.dto';
 import { moscowDate } from '../src/modules/investments/investment-calendar';
 import { BrokerageOperationsRepository } from '../src/modules/investments/operations/infrastructure/brokerage-operations.repository';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 // Financial proof uses real persisted rows/coverage and the configured HTTP boundary.
@@ -59,6 +60,8 @@ describe('local income completeness and exact money (SQLite)', () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(TbankClient)
      .useValue(upstream)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -266,7 +269,9 @@ describe('local income completeness and exact money (SQLite)', () => {
    await repo.fail(fence, false);
    const after = await read();
    expect(after.data).toEqual(before.data);
-    expect(after.meta.lastAttempt.state).toBe('failed');
+    // Without an hourly walk the durable attempt is absent; the failed
+    // source work stays a technical observation, not the hourly attempt.
+    expect(after.meta.lastAttempt.state).toBe('none');
    expect(upstream.getOperationsByCursor).not.toHaveBeenCalled();
  });
  it('retains current-month observed completeness and does not renew source timestamps', async () => {
@@ -15,6 +15,7 @@ import { TbankClient } from '../src/integrations/tbank/tbank.client';
 import { configureApp } from '../src/main';
 import { BrokerageOperationsRepository } from '../src/modules/investments/operations/infrastructure/brokerage-operations.repository';
 import { BrokerageOperationsResourceDto } from '../src/modules/investments/operations/presentation/brokerage-operation.dto';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 const uid = '11111111-1111-4111-8111-111111111111';
@@ -45,6 +46,8 @@ describe('persistent ledger HTTP and cursor (SQLite)', () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(TbankClient)
      .useValue(upstream)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -3,6 +3,7 @@ import type { Server } from 'node:http';
 import { INestApplication } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { Test } from '@nestjs/testing';
+import assert from 'node:assert/strict';
 import { setTimeout as delay } from 'node:timers/promises';
 import request from 'supertest';

@@ -15,8 +16,10 @@ import {
 } from '../src/integrations/tbank/tbank.client';
 import { configureApp } from '../src/main';
 import { BrokerageAccountsResourceDto } from '../src/modules/investments/brokerage-accounts/brokerage-account.dto';
+import { IncomeAnalyticsResourceDto } from '../src/modules/investments/income/income-analytics.dto';
 import { PortfolioService } from '../src/modules/investments/portfolio/application/portfolio.service';
 import { PortfolioResourceDto } from '../src/modules/investments/portfolio/presentation/portfolio.dto';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 function deferred<T>() {
@@ -101,6 +104,8 @@ describe('local accounts and portfolio HTTP (SQLite)', () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(TbankClient)
      .useValue(upstream)
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    configureApp(app);
@@ -325,6 +330,74 @@ describe('local accounts and portfolio HTTP (SQLite)', () => {
    expect(upstream.getPortfolio).toHaveBeenCalledTimes(1);
  });

+  it('reports the durable hourly attempt in accounts and income meta with section relevance', async () => {
+    await put().expect(200);
+    await seedMembership();
+    await requestPortfolio('account');
+    await settled();
+    const connection = await prisma.tbankConnection.findUniqueOrThrow({
+      where: { userId: 'owner' },
+    });
+    const startedAt = new Date('2026-10-10T10:00:00.000Z');
+    const finishedAt = new Date('2026-10-10T10:05:00.000Z');
+    await prisma.tbankSyncWork.create({
+      data: {
+        id: 'hourly-attempt',
+        userId: 'owner',
+        revision: connection.revision,
+        scopeKey: 'hourly',
+        intent: {},
+        state: 'complete',
+        attemptId: 'hourly-attempt',
+        processRunId: 'test',
+        priority: 0,
+        progress: {
+          result: 'partial',
+          sections: [
+            {
+              section: 'portfolio',
+              accountId: 'account',
+              errorCode: 'TBANK_UNAVAILABLE',
+            },
+            {
+              section: 'operations',
+              accountId: 'account',
+              errorCode: 'TBANK_UNAVAILABLE',
+            },
+          ],
+        },
+        createdAt: startedAt,
+        updatedAt: finishedAt,
+      },
+    });
+    const accounts = await get('brokerage-accounts').expect(200);
+    const accountsMeta = (accounts.body as BrokerageAccountsResourceDto).meta;
+    expect(accountsMeta.lastAttempt.state).toBe('partial');
+    expect(accountsMeta.lastAttempt.startedAt).toBe(startedAt.toISOString());
+    expect(accountsMeta.lastAttempt.finishedAt).toBe(finishedAt.toISOString());
+    expect(accountsMeta.lastAttempt.problems).toEqual([
+      {
+        section: 'portfolio',
+        accountId: 'account',
+        errorCode: 'TBANK_UNAVAILABLE',
+      },
+    ]);
+    const income = await get(
+      'brokerage-accounts/account/income-analytics?sync=observe',
+    ).expect(200);
+    const incomeMeta = (income.body as IncomeAnalyticsResourceDto).meta;
+    expect(incomeMeta.lastAttempt.state).toBe('partial');
+    expect(incomeMeta.lastAttempt.startedAt).toBe(startedAt.toISOString());
+    expect(incomeMeta.lastAttempt.finishedAt).toBe(finishedAt.toISOString());
+    expect(incomeMeta.lastAttempt.problems).toEqual([
+      {
+        section: 'operations',
+        accountId: 'account',
+        errorCode: 'TBANK_UNAVAILABLE',
+      },
+    ]);
+  });
+
  it('recovers abandoned discovery only on a data request and coalesces concurrent reads', async () => {
    await put().expect(200);
    const connection = await prisma.tbankConnection.update({
@@ -501,16 +574,30 @@ describe('local accounts and portfolio HTTP (SQLite)', () => {
    await put().expect(200);
    await seedMembership();
    const blocked = deferred<TbankPortfolio>();
-    upstream.getPortfolio.mockReturnValueOnce(blocked.promise);
-    await get('brokerage-accounts/account/portfolio').expect(200);
+    const started = deferred<void>();
+    upstream.getPortfolio.mockImplementationOnce(() => {
+      started.resolve();
+      return blocked.promise;
+    });
+    // Starts the real portfolio producer, the same path the hourly walk uses.
+    const late = await portfolioService.request(
+      'owner',
+      (await prisma.tbankConnection.findUniqueOrThrow({ where: { userId: 'owner' } })).revision,
+      'account',
+      true,
+    );
+    assert(late);
+    // The late upstream call must have begun before the connection is replaced.
+    await started.promise;
    await put().expect(200);
    await seedMembership();
    blocked.resolve({ positions: [] });
-    await delay(20);
+    // Barrier: the fenced producer's completion, not a timer.
+    await late.done;
+    expect(await prisma.tbankPortfolio.count()).toBe(0);
    const replaced = await get(
      'brokerage-accounts/account/portfolio?sync=observe',
    ).expect(200);
    expect((replaced.body as PortfolioResourceDto).data).toBeNull();
-    expect(await prisma.tbankPortfolio.count()).toBe(0);
  });
 });
@@ -129,13 +129,17 @@ describe('durable shared instrument metadata (SQLite)', () => {
  });
  it('coalesces twenty requests across users while giving each user a private handle', async () => {
    const blocked = deferred<TbankInstrument>();
-    upstream.getInstrumentByUid.mockReturnValue(blocked.promise);
+    const started = deferred<void>();
+    upstream.getInstrumentByUid.mockImplementation(() => {
+      started.resolve();
+      return blocked.promise;
+    });
    const responses = await Promise.all(
      Array.from({ length: 20 }, (_, i) =>
        service.read(i % 2 ? 'owner' : 'other', identity),
      ),
    );
-    await delay(10);
+    await started.promise;
    expect(upstream.getInstrumentByUid).toHaveBeenCalledTimes(1);
    const ids = new Set(responses.map((response) => response?.work?.id));
    expect(ids.size).toBe(2);
@@ -151,9 +155,13 @@ describe('durable shared instrument metadata (SQLite)', () => {
    'discards a producer after %s, including shared freshness, without borrowing another user token',
    async (action) => {
      const blocked = deferred<TbankInstrument>();
-      upstream.getInstrumentByUid.mockReturnValueOnce(blocked.promise);
+      const started = deferred<void>();
+      upstream.getInstrumentByUid.mockImplementationOnce(() => {
+        started.resolve();
+        return blocked.promise;
+      });
      await service.read('owner', identity);
-      await delay(10);
+      await started.promise;
      await service.read('other', identity);
      await prisma.tbankConnection.delete({ where: { userId: 'owner' } });
      if (action === 'replace') {
@@ -187,9 +195,13 @@ describe('durable shared instrument metadata (SQLite)', () => {
  );
  it('does not turn initiating credentials failure into a shared negative lookup or a foreign credentials error', async () => {
    const blocked = deferred<TbankInstrument>();
-    upstream.getInstrumentByUid.mockReturnValueOnce(blocked.promise);
+    const started = deferred<void>();
+    upstream.getInstrumentByUid.mockImplementationOnce(() => {
+      started.resolve();
+      return blocked.promise;
+    });
    await service.read('owner', identity);
-    await delay(10);
+    await started.promise;
    await service.read('other', identity);
    blocked.reject(new Error('INVALID_TBANK_TOKEN'));
    await settled();
@@ -226,7 +238,6 @@ describe('durable shared instrument metadata (SQLite)', () => {
    expect(failed?.fetchedAt).toEqual(old);
    if (!failedHandle) throw new Error('Expected forced refresh work');
    expect((await prisma.tbankSyncWork.findUniqueOrThrow({ where: { id: failedHandle } })).state).toBe('failed');
-    await delay(20);
    expect(upstream.getInstrumentByUid).toHaveBeenCalledTimes(calls + 1);
  });
  it('coalesces forced refresh and retains freshness/timestamp when it fails before the TTL', async () => {
@@ -285,7 +296,7 @@ describe('durable shared instrument metadata (SQLite)', () => {
    await prisma.$disconnect();
    service = createService();
    await service.read('owner', identity, true);
-    await delay(10);
+    // Observation starts no work, so a no-call assertion holds without waiting.
    expect(upstream.getInstrumentByUid).not.toHaveBeenCalled();
    await service.read('owner', identity);
    await settled();
@@ -151,8 +151,12 @@ describe('Request-driven operations synchronization (SQLite)', () => {

  it('joins overlapping account and instrument refresh into one atomic publication group', async () => {
    const gate = deferred<TbankOperationsByCursorResponse>();
+    const started = deferred<void>();
    upstream.getOperationsByCursor
-      .mockReturnValueOnce(gate.promise)
+      .mockImplementationOnce(() => {
+        started.resolve();
+        return gate.promise;
+      })
      .mockResolvedValue({
        hasNext: false,
        items: [{ ...operation(), instrumentUid: 'uid' }],
@@ -164,7 +168,7 @@ describe('Request-driven operations synchronization (SQLite)', () => {
        true,
      ),
    );
-    await delay(5);
+    await started.promise;
    const whole = requiredHandle(
      await service.request('owner', [january], true),
    );
@@ -0,0 +1,73 @@
+import { ConfigService } from '@nestjs/config';
+import assert from 'node:assert/strict';
+
+import { PortfolioRepository } from '../src/modules/investments/portfolio/infrastructure/portfolio.repository';
+import { PrismaService } from '../src/prisma/prisma.service';
+
+// Real SQLite transaction: a running attempt of the current revision publishes its snapshot.
+describe('portfolio publication (SQLite)', () => {
+  const prisma = new PrismaService(
+    new ConfigService({ DATABASE_URL: process.env.DATABASE_URL }),
+  );
+  const repository = new PortfolioRepository(prisma);
+  const snapshot = {
+    lastSuccessfulAt: '2026-01-01T00:00:00.000Z',
+    isStale: false,
+    totalsByCurrency: [],
+    positions: [],
+    cashBalances: [],
+    structure: {},
+  } as never;
+  const accountId = 'account';
+
+  beforeAll(async () => {
+    await prisma.$connect();
+    await prisma.user.create({
+      data: { id: 'owner', email: 'owner@example.invalid', passwordHash: 'synthetic' },
+    });
+  });
+  afterAll(async () => prisma.$disconnect());
+  beforeEach(async () => {
+    await prisma.tbankConnection.deleteMany();
+    await prisma.tbankConnection.create({
+      data: {
+        userId: 'owner',
+        revision: 'current',
+        encryptedToken: 'synthetic',
+        connectedAt: new Date(),
+        accounts: {
+          create: {
+            accountId,
+            type: 'brokerage',
+            name: 'Synthetic',
+            upstreamOrder: 0,
+          },
+        },
+      },
+    });
+  });
+
+  it('publishes the same snapshot for the running attempt of the current revision', async () => {
+    await prisma.tbankSyncWork.create({
+      data: {
+        id: 'live',
+        userId: 'owner',
+        revision: 'current',
+        scopeKey: `portfolio:${accountId}`,
+        intent: {},
+        state: 'running',
+        attemptId: 'live-attempt',
+        processRunId: 'run',
+        priority: 1,
+        progress: {},
+      },
+    });
+    const published = await repository.publish(
+      { id: 'live', attemptId: 'live-attempt', userId: 'owner', revision: 'current' },
+      accountId,
+      snapshot,
+    );
+    assert.equal(published, true);
+    expect(await prisma.tbankPortfolio.count()).toBe(1);
+  });
+});
@@ -21,6 +21,7 @@ import {
  TbankOperationsByCursorRequest,
 } from '../src/integrations/tbank/tbank.client';
 import { configureApp } from '../src/main';
+import { TbankHourlyScheduler } from '../src/modules/investments/tbank-sync/tbank-hourly.scheduler';
 import { PrismaService } from '../src/prisma/prisma.service';

 const evidenceDirectory = mkdtempSync(join(tmpdir(), 'wealthledger-read-evidence-'));
@@ -215,6 +216,8 @@ describe('T-Bank persisted read budget', () => {
      })
      .overrideProvider(NcrRatingsClient)
      .useValue({ rating: () => counted('ncrRating', null) })
+      .overrideProvider(TbankHourlyScheduler)
+      .useValue({ tick: jest.fn() })
      .compile();
    app = module.createNestApplication();
    app.use((_req: Request, res: Response, next: NextFunction) => {
Author	SHA1	Message	Date
ksv741	b20080ac85	chore(release): 2.2.0 Backend verify / commits (pull_request) Successful in 33s Details Backend verify / security (pull_request) Successful in 13s Details Backend verify / verify (pull_request) Successful in 5m38s Details Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend image / publish (push) Successful in 7m58s Details Backend verify / verify (push) Successful in 5m40s Details	2026-10-18 16:25:22 +03:00
codex-bot	32622c1dad	test: cover auth token, cookie and expiry boundaries (WealthLedger/backend#61) (#113 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 6m26s Details	2026-10-18 15:55:05 +03:00
codex-bot	4f485ab0e9	chore: adopt linear git model in backend docs (#111 ) Backend verify / commits (push) Skipped Details Backend verify / commits (pull_request) Failing after 30s Details Backend verify / security (pull_request) Skipped Details Backend verify / verify (pull_request) Skipped Details Backend verify / security (push) Successful in 11s Details Backend verify / verify (push) Failing after 4m44s Details	2026-10-17 14:19:19 +03:00
codex-bot	8a6f60d965	fix: translate permanent invalid-token errors on online entrypoints (WealthLedger/backend#59) (#110 ) Backend verify / commits (push) Skipped Details Backend verify / commits (pull_request) Failing after 33s Details Backend verify / security (pull_request) Skipped Details Backend verify / verify (pull_request) Skipped Details Backend verify / security (push) Successful in 11s Details Backend verify / verify (push) Failing after 6m40s Details	2026-10-16 23:23:12 +03:00
codex-bot	e03fad622b	fix: align password policy to 8-72 printable ASCII on register (WealthLedger/backend#60) (#109 ) Backend verify / commits (push) Skipped Details Backend verify / commits (pull_request) Failing after 32s Details Backend verify / security (pull_request) Skipped Details Backend verify / verify (pull_request) Skipped Details Backend verify / security (push) Successful in 10s Details Backend verify / verify (push) Failing after 6m21s Details	2026-10-16 10:00:47 +03:00
ksv741	774e58ef80	Merge branch 'chore/30-sync-release' into develop Backend verify / commits (push) Skipped Details Backend verify / commits (pull_request) Failing after 28s Details Backend verify / security (pull_request) Skipped Details Backend verify / verify (pull_request) Skipped Details Backend verify / security (push) Successful in 10s Details Backend verify / verify (push) Failing after 5m38s Details	2026-10-16 07:38:58 +03:00
codex-bot	702302126b	test: await portfolio publication done instead of polling ticks (WealthLedger/backend#63) (#103 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 13s Details Backend verify / verify (push) Failing after 5m25s Details Backend verify / commits (pull_request) Successful in 29s Details Backend verify / security (pull_request) Successful in 11s Details Backend verify / verify (pull_request) Successful in 4m39s Details	2026-10-15 15:40:03 +03:00
codex-bot	ec6d9a2639	test: replace metadata sleeps with upstream start barriers (WealthLedger/backend#63) (#102 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 15s Details Backend verify / verify (push) Failing after 6m46s Details	2026-10-15 14:46:09 +03:00
codex-bot	7bc7d8ddec	test: replace late portfolio sleep with started and done barriers (WealthLedger/backend#63) (#101 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 6m21s Details	2026-10-15 12:23:14 +03:00
codex-bot	9e4f9d9cab	test: isolate HTTP suites from scheduler and bank-card case order (WealthLedger/backend#65) (#100 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 5m59s Details	2026-10-15 11:50:47 +03:00
codex-bot	a93f2d55e7	chore: make OpenAPI export atomic and add read-only check (WealthLedger/backend#3) (#97 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 13s Details Backend verify / verify (push) Failing after 6m4s Details	2026-10-15 11:24:38 +03:00
codex-bot	96d4de4195	refactor: remove unreachable catalog producer and sync orchestration (WealthLedger/backend#62) (#98 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 5m47s Details	2026-10-15 10:46:58 +03:00
codex-bot	c789e33c41	chore: drop unused direct source-map-support dependency (WealthLedger/backend#4) (#96 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 5m22s Details	2026-10-15 06:15:47 +03:00
codex-bot	2ad3517d87	fix: restore screener OpenAPI constraints (WealthLedger/backend#70) (#95 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 12s Details Backend verify / verify (push) Failing after 5m50s Details	2026-10-15 06:00:39 +03:00
codex-bot	0d7839cf79	fix: separate T-Bank RPC network time from queue wait (WealthLedger/backend#81) (#94 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 11s Details Backend verify / verify (push) Successful in 5m20s Details	2026-10-15 05:41:21 +03:00
codex-bot	6975853656	fix: skip hourly terms overlapped by a long walk (WealthLedger/backend#54 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 13s Details Backend verify / verify (push) Failing after 6m56s Details	2026-10-14 22:43:08 +03:00
codex-bot	14bcb9da5f	fix: surface durable hourly attempt in accounts and income meta (WealthLedger/backend#58 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 17s Details Backend verify / verify (push) Failing after 7m31s Details	2026-10-14 18:00:20 +03:00
codex-bot	b90cedd580	chore: unify verification preparation (WealthLedger/backend#66 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 13s Details Backend verify / verify (push) Failing after 6m44s Details	2026-10-14 17:01:53 +03:00
codex-bot	da2e1d0781	perf: start bond search prices with details (WealthLedger/backend#71) (#89 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 14s Details Backend verify / verify (push) Failing after 6m48s Details	2026-10-14 14:04:07 +03:00
codex-bot	bbb5afff84	ci: validate edited PR titles (WealthLedger/backend#74 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 13s Details Backend verify / verify (push) Failing after 6m37s Details Closes #74	2026-10-14 09:02:53 +03:00
codex-bot	285dd08472	perf: batch bank operation page relations (WealthLedger/backend#68 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 11s Details Backend verify / verify (push) Failing after 6m20s Details Closes #68	2026-10-14 08:48:37 +03:00
codex-bot	1033d2114e	test: slim sqlite runner regression workload (WealthLedger/backend#72 ) Backend verify / commits (push) Skipped Details Backend verify / security (push) Successful in 11s Details Backend verify / verify (push) Failing after 5m47s Details Closes #72	2026-10-14 08:34:37 +03:00
ksv741	3d50db7903	ci: validate release PR commits independently (WealthLedger/main#30 ) Backend verify / commits (push) Skipped Details Backend image / publish (push) Successful in 7m28s Details Backend verify / security (push) Successful in 10s Details Backend verify / verify (push) Successful in 5m3s Details Backend verify / commits (pull_request) Successful in 27s Details Backend verify / security (pull_request) Successful in 10s Details Backend verify / verify (pull_request) Successful in 5m11s Details	2026-10-12 23:39:30 +03:00
ksv741	8d5569a3c7	chore(release): 2.1.0 Backend verify / commits (pull_request) Failing after 31s Details Backend verify / security (pull_request) Skipped Details Backend verify / verify (pull_request) Skipped Details	2026-10-12 23:19:12 +03:00