chore(release): 1.2.1

Reviewed-on: #80

.ai/conventions/data.md

@@ -30,7 +30,8 @@ backend checkout и не проверяют backend runtime OpenAPI; измен
 shape/status/route сохраняет
 публичный контракт предоставленного snapshot.
 Одна UI-модель не требует менять API. `openapi:generate` работает offline от snapshot;
-`openapi:check` генерирует во временный каталог и сравнивает, не меняя tracked files.
+`openapi:check` запускает native `--check` того же CLI и падает при устаревших
+generated types, не меняя tracked files.
 
 ## Auth и invalidation
 
@@ -39,6 +40,11 @@ Authorization. Auth endpoints исключены из Bearer/retry middleware. R
 координируется single-flight; после `401` с `UNAUTHORIZED` возможен один retry.
 Не добавляй собственный refresh/retry loop в caller.
 
+Refresh, завершившийся `401`, очищает session. Сетевая ошибка и `5xx`
+(например, деплой backend) не доказывают конец session: она сохраняется,
+`unavailable` показывает retry-экран вместо login, а следующий `401` снова
+запускает refresh. Retry/backoff внутри refresh не добавляется.
+
 Cookie-writing requests упорядочены только в текущей вкладке. Cross-tab auth
 synchronization не требуется; допустим reload/re-login. Web Locks и отдельные
 token stores не добавляются.

.ai/conventions/engineering.md

@@ -71,6 +71,7 @@ Peer-конфликт решай совместимыми версиями бе
 | Итерация | Адресные тесты, typecheck и lint по затронутому поведению и риску. При изменении поведения добавь/обнови содержательную регрессию, если существующая проверка не ловит её; для косметики не создавай искусственный тест. |
 | Итоговый code/dependency diff | Перед объявлением готовности и передачей к интеграции выполни один полный `npm run verify` на итоговых входах. Дополнительные risk checks из testing convention и явно утверждённые task checks обязательны; CI проверяет независимо. |
 | Только Markdown | Проверь тексты, ссылки/якоря, маршруты чтения и `git diff --check`; application build не нужен. При изменении verification-контура проверь его работу. |
+| Pre-commit | Hook не скачивает tools: вызывай установленные бинарники из `node_modules/.bin` (не `npx`). Full graph не входит в hook; он выполняется в `npm run verify` и CI. |
 
 Повтори routing по staged/unstaged/new files. В отчёте по задаче/PR запиши
 проверенные входы, команду, exit code, результат и ограничения. Повторяй
@@ -88,4 +89,9 @@ Commits и PR titles — Conventional Commits с parser-recognized Issue referen
 содержит одну связанную задачу. Исключения release и правила ссылки — в
 Engineering Workflow из AGENTS. Root другого checkout не управляет этим repo.
 Прямой push в `main`, force-push и перенос опубликованных тегов не входят в
-обычную работу. Перед release/hotfix прочитай местный README, раздел «Релизы».
+обычную работу. PR сливается squash или rebase-merge; merge-коммит не
+используется. `main` обновляется только fast-forward из `develop`, поэтому
+`origin/main` всегда предок `origin/develop`:
+`git merge-base --is-ancestor origin/main origin/develop`. Срочный fix —
+обычная ветка `fix/*` от `develop`; пути hotfix от `main` нет.
+Перед релизом прочитай местный README, раздел «Релизы».

.gitea/workflows/pr-title.yml

@@ -0,0 +1,34 @@
+name: Frontend verify
+
+# Metadata-only: refreshes only the `commits` context after a PR title edit.
+# Same workflow name keeps the required context; `security` and `verify`
+# statuses of the head revision stay untouched (no skipped overwrite).
+on:
+  pull_request:
+    types: [edited]
+
+concurrency:
+  group: frontend-pr-title-${{ gitea.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  commits:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - run: npm ci --ignore-scripts
+      - name: Check PR title and commits
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
+          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"

.gitea/workflows/verify.yml

@@ -34,7 +34,11 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           printf '%s\n' "$PR_TITLE" | npm run commitlint -- --strict
-          npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
+          if [[ "$PR_TITLE" =~ ^chore\(release\):\ [0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            npm run commitlint -- --strict --from "$HEAD_SHA^" --to "$HEAD_SHA"
+          else
+            npm run commitlint -- --strict --from "$BASE_SHA" --to "$HEAD_SHA"
+          fi
 
   security:
     needs: commits

.husky/pre-commit

@@ -1,3 +1,6 @@
 gitleaks git --pre-commit --staged --redact=100 --no-banner || exit $?
-npx lint-staged
-npm run deps
+if [ ! -x node_modules/.bin/lint-staged ]; then
+	echo "lint-staged is not installed; run npm ci" >&2
+	exit 1
+fi
+node_modules/.bin/lint-staged

.nvmrc

@@ -1 +1 @@
-24.21.0
+24.22.1

CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## [1.2.1](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v1.2.0...v1.2.1) (2026-10-24)
+
+### Bug Fixes
+
+* keep session when refresh fails on network error or 5xx (WealthLedger/frontend[#97](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/97)) ([3af9df0](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3af9df0ae2f0fb314c276504ef7d50a7472de680))
+* show snapshot time in browser time zone ([#101](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/101)) ([b009101](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/b009101b7b954e8462672a9da859267ebb71edc4))
+
+### Maintenance
+
+* bump Node to 24.22.1 (WealthLedger/backend[#122](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/122)) ([2cd6b1e](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/2cd6b1e72d97117b0c37465aac3d989b0469c1c3))
+* bump test stack and fix npm audit findings ([#105](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/105)) ([7e6fd95](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7e6fd95cfaf7d288242fb46ec7091f561e6f3de5))
+* **deps:** update non-major dependencies [#9](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/9) ([b5ceb77](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/b5ceb77208e35a0e389258f3d3c4b85852980042))
+* resolve dev dependency audit findings (WealthLedger/frontend[#103](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/103)) ([7b6f34c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/7b6f34c776fa3517c93b5c3468e3b277aaa6273f))
+
+## [1.2.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v1.1.0...v1.2.0) (2026-10-18)
+
+### Features
+
+* unify income payment cards and remove comparisons (WealthLedger/main[#33](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/33)) ([#74](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/74)) ([43b0f55](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/43b0f5574a79e26de0abae35de16d8aa8700f718))
+
+### Bug Fixes
+
+* align password validation with backend ASCII policy (WealthLedger/backend[#60](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/60)) ([#89](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/89)) ([ebe9268](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ebe92684a74b4e2617b04ef00d9406b8a0f674ea))
+* **auth,bank:** guard switch-auth nav and surface banking retry ([e38ecd8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e38ecd87d6f69968bb56e6035ceeb6cfda208a3f)), closes [#56](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/56) [#57](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/57)
+* **bank:** break BankFeedback's shared/api edge for stories ([#80](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/80)) ([2336804](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/233680448f97dc3ec57d7665ec14c68ac92410e5))
+* deliver screener OpenAPI constraints (WealthLedger/backend[#70](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/70)) ([#85](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/85)) ([ed63ada](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/ed63adad94f5d0e20f7d0d1446a235f953d10ec2))
+* **events:** seven-date default period and picker from today (WealthLedger/frontend[#63](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/63)) ([612ab62](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/612ab6250979bf8d9b57f4feb6e1476ed3d759e4))
+* respect query eligibility in screen sync (WealthLedger/frontend[#54](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/54)) ([f295dea](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f295dea6a6a33c597c753b52aff629d5382c963a))
+
+### Refactoring
+
+* derive payment-system options from schema tuple ([#58](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/58)) ([#75](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/75)) ([e67c47b](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e67c47b102329877eb5d9c9d8bb4ea7c0bc70883))
+
+### Build
+
+* use native openapi-typescript --check ([#60](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/60)) ([#77](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/77)) ([df05c8c](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/df05c8c7dbb5d6816fb95d54ca43cd0d83eecd48))
+
+### CI
+
+* keep pre-commit proportionate and avoid tool downloads (WealthLedger/frontend[#62](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/62)) ([#86](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/86)) ([d409a29](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/d409a297e5f9ae5658d4efa958bda9a012a859a1))
+* recheck PR title on edited without the full pipeline (WealthLedger/frontend[#64](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/64)) ([bc28973](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/bc28973d1ad5e15bfbc2e5b73b00ba63449933db))
+
+### Tests
+
+* await client settlement in late-response cases (WealthLedger/frontend[#61](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/61)) ([#81](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/81)) ([f3725c2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f3725c202bd8cef4ba711085df82a921a2da6b7d))
+* cover non-retry of INVALID_TBANK_TOKEN reads (WealthLedger/backend[#59](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/59)) ([#90](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/90)) ([5134106](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/513410669680480a1f68f5720744cc85e43c8286))
+* cover null events and income envelopes on account pages ([#72](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/72)) ([#79](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/79)) ([e5f8bbe](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/e5f8bbe33cd438f432281818c5276abe9a425646))
+* cover null resource envelopes for account pages ([#70](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/70)) ([#71](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/71)) ([#78](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/78)) ([f7f53ff](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/f7f53ff8e4de3c1d06fac6063974ff9667145ed6))
+
+### Maintenance
+
+* adopt linear git model in frontend docs ([#91](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/91)) ([eefdde2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/eefdde29f8da269581e90bd797078e10a39e472f))
+
+## [1.1.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v1.0.0...v1.1.0) (2026-10-12)
+
+### Features
+
+* add stock screener ([a84411d](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/a84411df39dc131290e9f5b5d9313fed17cc629a))
+* align investment client with hourly sync ([432cca2](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/432cca299f3a9a9e45b2697527369ee95f2d0adc))
+* render hourly investment states ([3c226f8](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/3c226f8c29efceccb75af0d6424639a757534f39))
+
+### Bug Fixes
+
+* align frontend workflow rules (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([c315f80](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c315f80b1b07ae0888366512ec157b8e29c81d62))
+* preserve latest stock screener result ([cec9c63](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/cec9c6348a389f16f272dac5533aebc9d12ceae8))
+* show bank summary totals ([20b2cdf](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/20b2cdfd432f8b01e447f68657cf5c685a297f1e))
+
+### Documentation
+
+* clarify frontend verification policy ([cac4351](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/cac4351bc4abf2cec7c5b6611a74d87bf4ec2f70))
+* pin frontend workflow reference (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([0d747cc](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/0d747cc93ee08c337cf300c0367612708f45dfb9))
+
+### CI
+
+* skip checks on PR metadata edits ([c882120](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/c8821200ce699dab1ce65360d1968d5877a2e78b))
+
+### Maintenance
+
+* align frontend engineering workflow (WealthLedger/main[#27](https://git.personal.ksv741.ru/WealthLedger/frontend/issues/27)) ([617edfd](https://git.personal.ksv741.ru/WealthLedger/frontend/commit/617edfd489a6a84bb33b57386eca4eb54661f4f0))
+
 ## [1.0.0](https://git.personal.ksv741.ru/WealthLedger/frontend/compare/v0.4.0...v1.0.0) (2026-10-07)
 
 ### ⚠ BREAKING CHANGES

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.21.0-bookworm-slim AS dependencies
+FROM node:24.22.1-bookworm-slim AS dependencies
 WORKDIR /app
 ENV HUSKY=0
 COPY package.json package-lock.json ./
@@ -19,7 +19,7 @@ COPY . .
 ENV VITE_API_BASE_URL=""
 RUN npm run build
 
-FROM nginx:1.28.0-alpine AS production
+FROM nginx:1.31.8-alpine AS production
 ARG VERSION
 ARG REVISION
 LABEL org.opencontainers.image.version=$VERSION \

README.md

@@ -19,8 +19,10 @@ npm run dev
 
 Для commits установите [Gitleaks](https://github.com/gitleaks/gitleaks/releases/tag/v8.30.1)
 8.30.1 в `PATH` (macOS: `brew install gitleaks`). Pre-commit сначала проверяет
-staged diff с полной редакцией секретов, затем запускает formatting и FSD checks.
-Находка или отсутствие Gitleaks блокирует commit.
+staged diff с полной редакцией секретов, затем запускает установленный
+`node_modules/.bin/lint-staged` только для staged JS/TS. Hook не скачивает tools и
+не запускает full graph: полный `npm run verify` выполняется в CI и перед передачей.
+Находка или отсутствие Gitleaks либо lint-staged блокирует commit.
 Проверка этого поведения: `node --test scripts/test-pre-commit.mjs`.
 
 ## Контейнерный image
@@ -116,7 +118,8 @@ Chromium при ширинах 375 и 1280 px. Browser project не исполь
 Единый `.gitea/workflows/verify.yml` запускает `commits → security → verify`
 последовательно на PR; на push в `develop`/`main` — `security → verify`.
 Рабочие ветки проверяются после открытия PR, без дублирующего push-запуска.
-Изменение заголовка PR тоже повторяет проверки Conventional Commits.
+Изменение заголовка PR запускает `.gitea/workflows/pr-title.yml` (то же имя workflow,
+только job `commits`): статусы `security` и `verify` на HEAD не перезаписываются.
 Новый запуск отменяет устаревший для того же PR/ветки и типа события
 (требуется Gitea 1.26+). Ежедневно в 05:17 UTC выполняется только `security`.
 Job `security` проверяет полную доступную историю Gitleaks 8.30.1 и выполняет
@@ -214,36 +217,59 @@ preset по имени из `.release-it.json`. Версия preset закреп
 Репозиторий выпускается независимо. `develop` — интеграция, `main` — принятые
 релизы. Обычная работа: issue-linked ветка от актуального `develop`, PR в `develop`;
 общие правила — в Engineering Workflow по ссылке из AGENTS.
-Обычные PR допускают squash; release и обратная синхронизация сохраняют историю.
+PR сливается squash или rebase-merge; merge-коммит не используется. `main`
+обновляется только fast-forward из `develop`, поэтому история линейна:
+
+```text
+<type>/<issue>-<slug> --squash--> develop --ff-only--> main --> tag vX.Y.Z
+```
+
+Инвариант: `origin/main` всегда предок `origin/develop`. Проверка:
+
+```bash
+git fetch -q origin
+git merge-base --is-ancestor origin/main origin/develop && echo ok || echo BROKEN
+```
+
 Commits и PR titles — Conventional Commits со ссылкой на Issue (кроме release),
 включая `spec:`. Версии вручную не повышай.
 
-1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Убедись, что
-   `develop` содержит последний релиз. Создай `release/<name>` от проверенного
-   `develop`; `nvm use --silent`, `npm ci`. Hotfix начинается от `main` в
-   `release/hotfix-<name>` и проходит тот же процесс.
+1. Получи `main`, `develop` и теги: `git fetch origin --tags`. Проверь
+   инвариант. Создай `release/X.Y.Z` от проверенного `develop`;
+   `nvm use --silent`, `npm ci`.
 2. На чистой ветке выполни `npm run release:preview`, просмотри версию/changelog,
    затем `npm run release:prepare`. Команда создаёт `chore(release): X.Y.Z`,
    обновляет manifest/lockfile/CHANGELOG; тег и push не выполняет. Не обходи
    guards ветки, чистого дерева, отсутствующих тегов или уже подготовленной версии.
 3. Проверь diff и штатные gates этого репозитория. Отправь только release-ветку,
-   открой PR в `main` с заголовком `chore(release): X.Y.Z`. После зелёных
-   `verify`, `security`, `commits` выполни fast-forward-only merge. Если `main`
-   изменился, согласуй историю и повтори проверки кандидата.
-4. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
+   открой PR в **`develop`** с заголовком `chore(release): X.Y.Z`. После зелёных
+   `verify`, `security`, `commits` выполни fast-forward-only merge. Если
+   `develop` изменился, обнови release-ветку и повтори проверки кандидата.
+4. Открой PR `develop → main` с тем же заголовком и слей fast-forward-only.
+5. Получи удалённый `main`, сравни его HEAD с проверенным release SHA и версией
    manifest/lockfile. Создай аннотированный `vX.Y.Z` именно на этом SHA:
    `git tag -a vX.Y.Z <release-sha> -m "Release X.Y.Z"`, затем отправь только
    `git push origin refs/tags/vX.Y.Z`. Не запускай release-it повторно на `main`.
-5. Верни release-коммит через PR `main → develop` без squash/rebase; проверь,
-   что `develop` содержит тег. Опубликованные теги не перемещай. При сбое после
-   merge создай отсутствующий тег без нового bump; до merge исправь и проверь
-   существующий кандидат без повторного повышения версии.
+
+Обратная синхронизация не нужна: release-коммит попал в `develop` на шаге 3.
+Опубликованные теги не перемещай. При сбое после merge создай отсутствующий тег
+без нового bump; до merge исправь и проверь существующий кандидат без
+повторного повышения версии.
+
+Freeze релиза не поддерживается: пока открыт релизный PR, `develop` не двигают.
+Срочный fix — обычная ветка `fix/*` от `develop` с последующим релизом;
+пути от `main` нет, он сделал бы `main` не-предком `develop`. Исключение
+требует явного решения: `release/hotfix-<name>` от `main`, PR в `main`, тег,
+затем merge `main → develop` для восстановления инварианта.
 
 `feat:` повышает minor, `fix:`/`perf:` и прочие разрешённые типы — patch;
 `!`/`BREAKING CHANGE:` — major, включая версии до 1.0. `chore(release):`
 исключён из рекомендации и changelog. Конфигурация — `.release-it.json`.
 В Gitea для `main`/`develop` должны быть запрещены прямой/force push и обход
-администратором, обязательны `verify`, `security`, `commits`; теги `v*` защищены.
+администратором, включена блокировка устаревшей ветки, обязательны `verify`,
+`security`, `commits`; теги `v*` защищены. Линейность обеспечивают merge styles
+репозитория: merge-коммиты и rebase `--no-ff` выключены, доступны squash,
+rebase-merge и fast-forward-only; стиль по умолчанию — squash.
 Workflow сам не включает эти настройки. Отдельное review approval для одного
 владельца не требуется. Npm publishing, deploy и Gitea Releases не включены.
 

package.json

@@ -1,10 +1,10 @@
 {
 	"name": "wealth-ledger-frontend",
 	"private": true,
-	"version": "1.0.0",
+	"version": "1.2.1",
 	"type": "module",
 	"engines": {
-		"node": "24.21.0"
+		"node": "24.22.1"
 	},
 	"scripts": {
 		"dev": "npm run build:packages && vite",
@@ -20,7 +20,7 @@
 		"test:coverage": "npm run build:packages && vitest run --coverage",
 		"test:lint": "node --test scripts/test-eslint.mjs",
 		"openapi:generate": "openapi-typescript src/shared/api/spec/openapi.json -o src/shared/api/generated/schema.d.ts",
-		"openapi:check": "node scripts/check-openapi.mjs",
+		"openapi:check": "openapi-typescript src/shared/api/spec/openapi.json -o src/shared/api/generated/schema.d.ts --check",
 		"knip": "npm run build:packages && knip",
 		"deps": "npm run build:packages && depcruise src packages --config dependency-cruiser.cjs --output-type err-long",
 		"verify": "npm run build:packages && npm run openapi:check && tsc -b --noEmit && eslint . --max-warnings=0 && npm run test:lint && vitest run --coverage && knip && depcruise src packages --config dependency-cruiser.cjs --output-type err-long && depcruise src packages .storybook/preview.tsx --config .storybook/dependency-cruiser.cjs --output-type err-long && tsc -b && vite build && storybook build --output-dir storybook-static --disable-telemetry",
@@ -37,89 +37,94 @@
 		"*.{js,mjs,cjs,ts,tsx}": "eslint --fix --max-warnings=0 --no-warn-ignored"
 	},
 	"dependencies": {
-		"@hookform/resolvers": "5.9.1",
-		"@mantine/charts": "9.6.1",
-		"@mantine/core": "9.6.1",
-		"@mantine/dates": "9.6.1",
-		"@mantine/hooks": "9.6.1",
-		"@mantine/notifications": "9.6.1",
-		"@tanstack/react-query": "5.102.8",
+		"@hookform/resolvers": "5.9.2",
+		"@mantine/charts": "9.7.3",
+		"@mantine/core": "9.7.3",
+		"@mantine/dates": "9.7.3",
+		"@mantine/hooks": "9.7.3",
+		"@mantine/notifications": "9.7.3",
+		"@tanstack/react-query": "5.104.5",
 		"@wealthledger/icons": "file:packages/icons",
 		"@wealthledger/tokens": "file:packages/tokens",
 		"@wealthledger/ui": "file:packages/ui",
 		"dayjs": "1.11.23",
-		"i18next": "26.4.2",
-		"motion": "13.2.0",
+		"i18next": "26.5.10",
+		"motion": "13.5.1",
 		"openapi-fetch": "0.17.0",
 		"openapi-react-query": "0.5.4",
-		"react": "19.3.0",
-		"react-dom": "19.3.0",
-		"react-hook-form": "7.88.0",
-		"react-i18next": "17.0.14",
-		"react-is": "19.3.0",
-		"react-router": "8.3.1",
+		"react": "19.3.1",
+		"react-dom": "19.3.1",
+		"react-hook-form": "7.91.0",
+		"react-i18next": "17.1.8",
+		"react-is": "19.3.1",
+		"react-router": "8.5.0",
 		"recharts": "3.10.1",
-		"zod": "4.6.4"
+		"zod": "4.6.7"
 	},
 	"devDependencies": {
-		"@babel/core": "8.0.5",
-		"@commitlint/cli": "21.2.2",
-		"@commitlint/config-conventional": "21.2.2",
-		"@eslint-react/eslint-plugin": "5.21.0",
+		"@babel/core": "8.0.9",
+		"@commitlint/cli": "21.2.4",
+		"@commitlint/config-conventional": "21.2.4",
+		"@eslint-react/eslint-plugin": "5.28.8",
 		"@eslint/js": "10.0.1",
-		"@release-it/conventional-changelog": "12.0.0",
+		"@release-it/conventional-changelog": "12.0.2",
 		"@rolldown/plugin-babel": "0.2.4",
-		"@storybook/addon-docs": "10.6.0",
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/addon-docs": "10.6.3",
+		"@storybook/react-vite": "10.6.3",
 		"@stylistic/eslint-plugin": "5.10.0",
-		"@tanstack/eslint-plugin-query": "5.104.0",
+		"@tanstack/eslint-plugin-query": "5.104.5",
 		"@testing-library/jest-dom": "7.0.1",
 		"@testing-library/react": "16.3.3",
-		"@types/node": "24.13.4",
+		"@types/node": "24.19.2",
 		"@types/react": "19.3.0",
 		"@types/react-dom": "19.3.0",
-		"@vitejs/plugin-react": "6.1.1",
-		"@vitest/browser-playwright": "5.0.0",
-		"@vitest/coverage-v8": "5.0.0",
+		"@vitejs/plugin-react": "6.1.2",
+		"@vitest/browser": "5.0.5",
+		"@vitest/browser-playwright": "5.0.5",
+		"@vitest/coverage-v8": "5.0.5",
 		"@vitest/eslint-plugin": "1.6.27",
+		"@vitest/ui": "5.0.5",
 		"babel-plugin-react-compiler": "1.0.0",
-		"conventional-changelog-conventionalcommits": "10.4.0",
-		"dependency-cruiser": "18.2.0",
-		"eslint": "10.11.0",
+		"conventional-changelog-conventionalcommits": "10.4.1",
+		"dependency-cruiser": "18.7.0",
+		"eslint": "10.13.0",
 		"eslint-import-resolver-typescript": "4.4.5",
 		"eslint-plugin-import-x": "4.17.1",
 		"eslint-plugin-jest-dom": "5.10.1",
 		"eslint-plugin-no-unsanitized": "4.1.5",
-		"eslint-plugin-perfectionist": "5.12.1",
+		"eslint-plugin-perfectionist": "5.13.0",
 		"eslint-plugin-react-hooks": "7.1.1",
 		"eslint-plugin-react-refresh": "0.5.7",
 		"eslint-plugin-regexp": "3.3.1",
-		"eslint-plugin-security": "4.1.0",
-		"eslint-plugin-sonarjs": "4.2.1",
-		"eslint-plugin-storybook": "10.6.0",
+		"eslint-plugin-security": "4.2.0",
+		"eslint-plugin-sonarjs": "4.2.2",
+		"eslint-plugin-storybook": "10.6.3",
 		"eslint-plugin-testing-library": "7.16.2",
 		"eslint-plugin-unicorn": "76.0.0",
-		"globals": "17.12.0",
+		"globals": "17.13.0",
 		"husky": "9.1.7",
-		"jsdom": "30.0.1",
-		"knip": "6.35.1",
-		"lint-staged": "17.5.1",
+		"jsdom": "30.1.3",
+		"knip": "6.43.0",
+		"lint-staged": "17.6.0",
 		"msw": "2.15.0",
 		"openapi-typescript": "7.13.0",
-		"playwright": "1.63.0",
-		"release-it": "21.0.2",
-		"storybook": "10.6.0",
+		"playwright": "1.64.1",
+		"release-it": "21.1.1",
+		"storybook": "10.6.3",
 		"typescript": "5.9.3",
-		"typescript-eslint": "8.70.1",
-		"vite": "8.3.0",
+		"typescript-eslint": "8.72.0",
+		"vite": "8.3.5",
 		"vite-plugin-pwa": "1.3.0",
-		"vitest": "5.0.0"
+		"vitest": "5.0.5"
 	},
 	"overrides": {
 		"release-it": {
-			"basic-ftp": "6.2.1",
-			"undici": "7.29.1"
-		}
+			"basic-ftp": "6.2.3",
+			"undici": "8.12.3"
+		},
+		"@vitest/browser": "5.0.5",
+		"@vitest/ui": "5.0.5",
+		"@vitest/mocker": "5.0.5"
 	},
 	"allowScripts": {
 		"esbuild@0.28.2": true,

packages/icons/package.json

@@ -20,14 +20,14 @@
 		"build": "vite build && tsc -p tsconfig.json"
 	},
 	"peerDependencies": {
-		"react": "19.3.0"
+		"react": "19.3.1"
 	},
 	"devDependencies": {
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/react-vite": "10.6.3",
 		"@testing-library/react": "16.3.3",
 		"@types/react": "19.3.0",
 		"typescript": "5.9.3",
-		"vite": "8.3.0",
-		"vitest": "5.0.0"
+		"vite": "8.3.5",
+		"vitest": "5.0.5"
 	}
 }

packages/ui/package.json

@@ -27,18 +27,18 @@
 		"@wealthledger/tokens": "0.3.0"
 	},
 	"peerDependencies": {
-		"@mantine/core": "9.6.1",
-		"@mantine/hooks": "9.6.1",
-		"react": "19.3.0",
-		"react-dom": "19.3.0"
+		"@mantine/core": "9.7.3",
+		"@mantine/hooks": "9.7.3",
+		"react": "19.3.1",
+		"react-dom": "19.3.1"
 	},
 	"devDependencies": {
-		"@storybook/react-vite": "10.6.0",
+		"@storybook/react-vite": "10.6.3",
 		"@testing-library/react": "16.3.3",
 		"@types/react": "19.3.0",
-		"storybook": "10.6.0",
+		"storybook": "10.6.3",
 		"typescript": "5.9.3",
-		"vite": "8.3.0",
-		"vitest": "5.0.0"
+		"vite": "8.3.5",
+		"vitest": "5.0.5"
 	}
 }

scripts/check-openapi.mjs

@@ -1,45 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { mkdtemp, readFile, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import nodePath from "node:path";
-
-const temporaryDirectory = await mkdtemp(
-	nodePath.join(tmpdir(), "wealth-ledger-openapi-"),
-);
-
-const generatedPath = nodePath.join(temporaryDirectory, "schema.d.ts");
-const committedPath = nodePath.resolve("src/shared/api/generated/schema.d.ts");
-const cliPath = nodePath.resolve("node_modules/openapi-typescript/bin/cli.js");
-let exitCode = 0;
-
-try {
-	const generated = spawnSync(
-		process.execPath,
-		[cliPath, "src/shared/api/spec/openapi.json", "-o", generatedPath],
-		{ encoding: "utf8" },
-	);
-
-	if (generated.status === 0) {
-		const [committed, current] = await Promise.all([
-			readFile(committedPath, "utf8"),
-			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
-			readFile(generatedPath, "utf8"),
-		]);
-
-		if (committed !== current) {
-			console.error(
-				"Generated OpenAPI types are stale. Run `npm run openapi:generate` and commit the result.",
-			);
-			exitCode = 1;
-		}
-	}
-	else {
-		process.stderr.write(generated.stderr || generated.stdout);
-		exitCode = generated.status ?? 1;
-	}
-}
-finally {
-	await rm(temporaryDirectory, { force: true, recursive: true });
-}
-
-process.exitCode = exitCode;

scripts/test-eslint.mjs

@@ -85,7 +85,7 @@ test("ESLint enforces the frontend profile and excludes generated artifacts", as
 			"security/detect-non-literal-regexp",
 		],
 		[
-			"scripts/check-openapi.mjs",
+			"scripts/test-pre-commit.mjs",
 			"import { exec } from \"node:child_process\"; exec(process.argv[2]);",
 			"security/detect-child-process",
 		],

scripts/test-pre-commit.mjs

@@ -47,6 +47,12 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		}
 
 		git("init", "--quiet");
+		// The hook must run the installed lint-staged binary, never download one.
+		const localBin = nodePath.join(cwd, "node_modules", ".bin");
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		mkdirSync(localBin, { recursive: true });
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		writeFileSync(nodePath.join(localBin, "lint-staged"), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
 		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
 		writeFileSync(nodePath.join(cwd, "sample.txt"), "safe staged content\n");
 		git("add", "sample.txt");
@@ -77,3 +83,37 @@ test("pre-commit scans the index, redacts findings and fails closed", () => {
 		rmSync(cwd, { force: true, recursive: true });
 	}
 });
+
+test("pre-commit never downloads tools and blocks when lint-staged is missing", () => {
+	const hook = nodePath.resolve(".husky/pre-commit");
+	const cwd = mkdtempSync(nodePath.join(tmpdir(), "frontend-hook-"));
+	const bin = nodePath.join(cwd, "bin");
+	const marker = nodePath.join(cwd, "downstream");
+
+	try {
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		mkdirSync(bin);
+		// Gitleaks passes; npx/npm must never be reached, even if present on PATH.
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		writeFileSync(nodePath.join(bin, "gitleaks"), "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+
+		for (const command of ["npx", "npm"]) {
+			// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+			writeFileSync(nodePath.join(bin, command), "#!/bin/sh\necho ran >> downstream\n", { mode: 0o755 });
+		}
+
+		const result = spawnSync("/bin/sh", ["-e", hook], {
+			cwd,
+			encoding: "utf8",
+			env: { ...process.env, PATH: `${bin}${nodePath.delimiter}${process.env.PATH}` },
+		});
+
+		assert.notEqual(result.status, 0, "missing lint-staged must block commit");
+		assert.match(result.stderr, /lint-staged is not installed/);
+		// eslint-disable-next-line security/detect-non-literal-fs-filename -- Path is built from this check’s private mkdtemp directory and fixed filenames.
+		assert.ok(!existsSync(marker), "hook must not invoke npx or npm");
+	}
+	finally {
+		rmSync(cwd, { force: true, recursive: true });
+	}
+});

src/app/routes/AppRoutes/AllAccounts.test.tsx

@@ -18,12 +18,21 @@ import type { IncomeAnalytics } from "@/entities/income";
 import type { Portfolio } from "@/entities/portfolio";
 
 import { AuthProvider } from "@/features/auth";
+import { defaultPeriod, formatDate } from "@/shared/lib";
 import { createTestQueryClient } from "@/test/query";
 import { resource } from "@/test/resource";
 import { server } from "@/test/server";
 
 import { AppRoutes } from "./AppRoutes";
 
+// Mantine calendar labels follow dayjs default (English) locale.
+function dayLabel(date: string) {
+	const monthName = new Intl.DateTimeFormat("en", { month: "long" })
+		.format(new Date(`${date}T12:00:00Z`));
+
+	return `${Number(date.slice(8))} ${monthName} ${date.slice(0, 4)}`;
+}
+
 const accounts = [
 	{ id: "a", name: "Основной" },
 	{ id: "b", name: "ИИС" },
@@ -233,7 +242,7 @@ describe("All accounts routes", () => {
 		);
 	});
 
-	it.each(["operations", "events", "income"])(
+	it.each(["operations", "income"])(
 		"restores applied dates when switching accounts in %s",
 		async (section) => {
 			const search = "?from=2026-08-01&to=2026-08-31";
@@ -261,6 +270,31 @@ describe("All accounts routes", () => {
 		},
 	);
 
+	it("restores applied dates when switching accounts in events", async () => {
+		// The events calendar blocks past dates, so pick within selectable dates.
+		const search = `?from=${defaultPeriod()[0]}&to=${defaultPeriod()[1]}`;
+		renderPage(`/accounts/all/events${search}`);
+		const picker = await screen.findByLabelText("Период");
+		fireEvent.click(picker);
+		const [fromDate, toDate] = defaultPeriod();
+		fireEvent.click(
+			await screen.findByRole("button", { name: dayLabel(fromDate) }),
+		);
+		fireEvent.click(
+			await screen.findByRole("button", { name: dayLabel(toDate) }),
+		);
+		expect(screen.getByLabelText("Период")).toHaveTextContent(
+			`${formatDate(fromDate)} – ${formatDate(toDate)}`,
+		);
+		fireEvent.click(screen.getByRole("combobox", { name: "Счёт" }));
+		fireEvent.click(await screen.findByRole("option", { name: "ИИС" }));
+		await waitFor(() =>
+			expect(screen.getByLabelText("Текущий путь")).toHaveTextContent(
+				`/accounts/b/events${search}`,
+			),
+		);
+	});
+
 	it("groups the same security and links its accounts and overview sections", async () => {
 		renderPage("/accounts/all");
 		expect(await screen.findAllByText("Сбербанк")).toHaveLength(1);

src/app/routes/AppRoutes/AppRoutes.test.tsx

@@ -190,6 +190,30 @@ describe("AppRoutes", () => {
 		expect(document.title).toBe("Карты — WealthLedger");
 	});
 
+	it("offers a retry instead of the login form while the server is unreachable, then restores the route", async () => {
+		let isOutage = true;
+		server.use(
+			http.post("*/api/v1/auth/refresh", () =>
+				isOutage
+					? new HttpResponse(null, { status: 502 })
+					: HttpResponse.json({
+							accessToken: "test-token",
+							user: { email: "user@example.com", id: "user-1" },
+						}),
+			),
+		);
+		renderRoutes("/accounts");
+
+		expect(await screen.findByRole("alert")).toHaveTextContent("Не удалось подключиться");
+		expect(screen.queryByRole("heading", { name: "Вход" })).not.toBeInTheDocument();
+		isOutage = false;
+		fireEvent.click(screen.getByRole("button", { name: "Повторить" }));
+
+		expect(
+			await screen.findByRole("heading", { level: 2, name: "Нет инвестиционных счетов" }),
+		).toBeVisible();
+	});
+
 	it("lazy-loads the protected shell for an authenticated accounts route", async () => {
 		server.use(
 			http.post("*/api/v1/auth/refresh", () =>

src/app/routes/RouteErrorBoundary/RouteErrorBoundary.tsx

@@ -10,7 +10,6 @@ import { useAuth } from "@/features/auth";
 
 type BoundaryProps = PropsWithChildren<{
 	authenticated: boolean;
-	routeKey: string;
 }>;
 
 type RouteErrorFallbackProps = {
@@ -26,12 +25,6 @@ class Boundary extends Component<BoundaryProps, State> {
 
 	override state: State = { hasError: false };
 
-	override componentDidUpdate(previousProps: BoundaryProps) {
-		if (previousProps.routeKey !== this.props.routeKey && this.state.hasError) {
-			this.setState({ hasError: false });
-		}
-	}
-
 	override render() {
 		return this.state.hasError
 			? <RouteErrorFallback authenticated={this.props.authenticated} />
@@ -70,10 +63,7 @@ const RouteErrorBoundary: FC<PropsWithChildren> = (props) => {
 	const { user } = useAuth();
 
 	return (
-		<Boundary
-			authenticated={Boolean(user)}
-			routeKey={`${pathname}${search}:${key}`}
-		>
+		<Boundary authenticated={Boolean(user)} key={`${pathname}${search}:${key}`}>
 			{children}
 		</Boundary>
 	);

src/app/routes/RouteGuards.tsx

@@ -1,4 +1,7 @@
+import { Button, Container } from "@mantine/core";
+import { StateView } from "@wealthledger/ui";
 import { type FC, type PropsWithChildren, useState } from "react";
+import { useTranslation } from "react-i18next";
 import { Navigate, useLocation } from "react-router";
 
 import { useAuth } from "@/features/auth";
@@ -7,12 +10,26 @@ import { RouteSkeleton } from "./RouteFallback";
 
 const Protected: FC<PropsWithChildren> = (props) => {
 	const { children } = props;
-	const { ready, signedOut, user } = useAuth();
+	const { ready, retry, signedOut, unavailable, user } = useAuth();
+	const { t } = useTranslation();
 	const location = useLocation();
 	const [wasAuthenticated, setWasAuthenticated] = useState(false);
 	if (user && !wasAuthenticated) setWasAuthenticated(true);
 	if (!ready) return <RouteSkeleton variant="shell" />;
 
+	// The server was unreachable (e.g. mid-deploy), so the session is unproven, not gone.
+	if (!user && unavailable)
+		return (
+			<Container py="xl" size={560}>
+				<StateView
+					action={<Button onClick={retry}>{t("auth.retry")}</Button>}
+					error
+					text={t("auth.unavailableText")}
+					title={t("auth.unavailableTitle")}
+				/>
+			</Container>
+		);
+
 	const loginState = signedOut && wasAuthenticated
 		? undefined
 		: { returnTo: `${location.pathname}${location.search}` };

src/entities/bank-card/model/error-code.ts

@@ -0,0 +1,7 @@
+function errorCode(error: unknown): string | undefined {
+	return typeof error === "object" && error !== null && "code" in error
+		? String(error.code)
+		: undefined;
+}
+
+export { errorCode };

src/entities/bank-card/ui/BankFeedback.tsx

@@ -3,7 +3,7 @@ import type { FC } from "react";
 import { Alert, Button, Group, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";
 
-import { apiErrorCode } from "@/shared/api";
+import { errorCode } from "../model/error-code";
 
 type BankFeedbackProps = {
 	cached?: boolean;
@@ -14,7 +14,7 @@ type BankFeedbackProps = {
 
 const BankFeedback: FC<BankFeedbackProps> = (props) => {
 	const { t } = useTranslation();
-	const code = apiErrorCode(props.error);
+	const code = errorCode(props.error);
 
 	return (
 		<Alert color="orange" role="alert">

src/entities/bank-card/ui/BankSummary/BankSummary.view.tsx

@@ -10,6 +10,7 @@ import { formatMoney } from "@/shared/lib";
 import type { BankSummary } from "../../api/types";
 
 import { bankOperationAppearance } from "../../model/operation-appearance";
+import { BankFeedback } from "../BankFeedback";
 import classes from "./BankSummary.module.css";
 
 const CATEGORY_COLUMNS = 2;
@@ -17,9 +18,10 @@ const CATEGORY_COLUMNS = 2;
 type BankSummaryViewProps = {
 	all?: boolean;
 	data?: BankSummary;
-	error: boolean;
+	error: unknown;
 	fetching: boolean;
 	loading: boolean;
+	retry?: () => void;
 };
 
 const BankSummaryViewCategories: FC<BankSummaryViewProps> = (props) => {
@@ -122,7 +124,14 @@ const BankSummaryView: FC<BankSummaryViewProps> = (props) => {
 
 			<BankSummaryViewCategories {...props} />
 
-			{props.error && !props.data && <Text role="alert">{t("bank.error")}</Text>}
+			{Boolean(props.error) && (
+				<BankFeedback
+					cached={Boolean(props.data)}
+					error={props.error}
+					loadingError={!props.data}
+					retry={props.retry}
+				/>
+			)}
 		</Stack>
 	);
 };

src/features/auth/model/auth-context.ts

@@ -7,7 +7,12 @@ type AuthContextValue = {
 	logout: () => Promise<void>;
 	ready: boolean;
 	register: (email: string, password: string) => Promise<void>;
+	retry: () => void;
 	signedOut: boolean;
+	/**
+	Refresh failed with a network error or 5xx; the refresh cookie may still be valid.
+	*/
+	unavailable: boolean;
 	user: undefined | User;
 };
 

src/features/auth/model/auth.schema.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from "vitest";
+
+import { loginSchema, registerSchema } from "./auth.schema";
+
+const email = "user@example.com";
+
+function canLogIn(password: string) {
+	return loginSchema.safeParse({ email, password }).success;
+}
+
+function canRegister(password: string, confirmation = password) {
+	return registerSchema.safeParse({
+		email,
+		password,
+		passwordConfirmation: confirmation,
+	}).success;
+}
+
+// Register policy: 8..72 printable ASCII (bcrypt reads 72 bytes, so non-ASCII could be
+// truncated). Login stays lenient so accounts created under the old policy still sign in.
+describe("auth password policy", () => {
+	it.each([
+		["7 chars", "a".repeat(7), false],
+		["8 chars", "a".repeat(8), true],
+		["72 chars", "a".repeat(72), true],
+		["73 chars", "a".repeat(73), false],
+		["printable symbols and space", "Aa1 !~\"#$%&'()*+,-./:;<=>?@", true],
+		["Cyrillic, 8+ chars", "пароль-пароль", false],
+		["emoji", "passw😀rd", false],
+		["tab", "pass\tword1", false],
+		["newline", "password1\n", false],
+		["DEL", "password\u{7F}1", false],
+	])("register: %s", (_, password, accepted) => {
+		expect(canRegister(password)).toBe(accepted);
+	});
+
+	it("register compares the raw password with its confirmation", () => {
+		const padded = "  spaced pass  ";
+
+		expect(canRegister(padded)).toBe(true);
+		expect(canRegister(padded, padded.trim())).toBe(false);
+	});
+
+	it.each([
+		["legacy Cyrillic password", "пароль-пароль", true],
+		["short legacy password", "short", true],
+		["72 bytes", "a".repeat(72), true],
+		["73 bytes", "a".repeat(73), false],
+		["36 Cyrillic letters = 72 bytes", "я".repeat(36), true],
+		["37 Cyrillic letters = 74 bytes", "я".repeat(37), false],
+		["empty", "", false],
+	])("login: %s", (_, password, accepted) => {
+		expect(canLogIn(password)).toBe(accepted);
+	});
+});

src/features/auth/model/auth.schema.ts

@@ -7,8 +7,10 @@ const EMAIL_PART_COUNT = 2;
 const ASCII_SPACE = 32;
 const ASCII_DELETE = 127;
 const MAX_EMAIL_LENGTH = 254;
-const MIN_PASSWORD_BYTES = 12;
+const MIN_PASSWORD_LENGTH = 8;
 const MAX_PASSWORD_BYTES = 72;
+// Printable ASCII keeps characters == bytes, within the bcrypt 72-byte limit.
+const ASCII_TILDE = 126;
 
 function isEmailCharacterInvalid(character: string): boolean {
 	const codePoint = character.codePointAt(0);
@@ -20,6 +22,14 @@ function isEmailCharacterInvalid(character: string): boolean {
 	);
 }
 
+function isPrintableAscii(value: string): boolean {
+	return value.split("").every((character) => {
+		const code = character.codePointAt(0) ?? 0;
+
+		return code >= ASCII_SPACE && code <= ASCII_TILDE;
+	});
+}
+
 const email = z
 	.string()
 	.trim()
@@ -33,28 +43,42 @@ const email = z
 		{ error: validationMessage("auth.validation.invalidEmail") },
 	);
 
-const password = z
+// Login stays lenient: accounts created under an older policy must still sign in.
+const loginPassword = z
 	.string()
+	.min(1)
 	.refine(
-		value =>
-			new TextEncoder().encode(value).length >= MIN_PASSWORD_BYTES
-				&& new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
-		{ error: validationMessage("auth.validation.invalidPasswordLength") },
+		value => new TextEncoder().encode(value).length <= MAX_PASSWORD_BYTES,
+		{ error: validationMessage("auth.validation.passwordTooLong") },
 	);
 
+const registerPassword = z
+	.string()
+	.min(MIN_PASSWORD_LENGTH, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	})
+	.max(MAX_PASSWORD_BYTES, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	})
+	.refine(isPrintableAscii, {
+		error: validationMessage("auth.validation.invalidPasswordLength"),
+	});
+
 const loginSchema = z.object({
 	email,
-	password,
+	password: loginPassword,
 	passwordConfirmation: z.string().optional(),
 });
 
-const registerSchema = loginSchema.refine(
-	value => value.password === value.passwordConfirmation,
-	{
-		error: validationMessage("auth.validation.passwordsDoNotMatch"),
-		path: ["passwordConfirmation"],
-	},
-);
+const registerSchema = loginSchema
+	.extend({ password: registerPassword })
+	.refine(
+		value => value.password === value.passwordConfirmation,
+		{
+			error: validationMessage("auth.validation.passwordsDoNotMatch"),
+			path: ["passwordConfirmation"],
+		},
+	);
 
 type AuthFormValues = z.input<typeof loginSchema>;
 

src/features/auth/model/auth.test.tsx

@@ -92,8 +92,10 @@ describe("AuthProvider", () => {
 		);
 	});
 
-	it("settles unauthenticated and clears cached data when cold-start refresh has a transport error", async () => {
-		server.use(http.post("*/api/v1/auth/refresh", () => HttpResponse.error()));
+	it("settles unauthenticated and clears cached data when cold-start refresh is rejected with 401", async () => {
+		server.use(http.post("*/api/v1/auth/refresh", () =>
+			HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 }),
+		));
 		const queryClient = createTestQueryClient();
 		queryClient.setQueryData(["cached-query"], { value: "stale" });
 		queryClient.setQueryData(bankCardsKey, [{ id: "bank-card-1" }]);
@@ -103,12 +105,54 @@ describe("AuthProvider", () => {
 		await waitFor(() => expect(result.current.ready).toBe(true));
 
 		expect(result.current.user).toBeUndefined();
+		expect(result.current.unavailable).toBe(false);
 		expect(await requestAuthorization()).toBeNull();
 		expect(queryClient.getQueryData(["cached-query"])).toBeUndefined();
 		expect(queryClient.getQueryData(bankCardsKey)).toBeUndefined();
 	});
 
-	it("keeps the original protected 401 when serialized refresh has a transport error", async () => {
+	it.each([
+		["a transport error", () => HttpResponse.error()],
+		["a 502 from the proxy", () => new HttpResponse(null, { status: 502 })],
+		["a 503 problem", () => HttpResponse.json({ code: "INTERNAL_SERVER_ERROR" }, { status: 503 })],
+	])("settles as unavailable and keeps cached data when cold-start refresh gets %s", async (_name, failure) => {
+		server.use(http.post("*/api/v1/auth/refresh", failure));
+		const queryClient = createTestQueryClient();
+		queryClient.setQueryData(["cached-query"], { value: "kept" });
+		const wrapper: FC<PropsWithChildren> = createAuthWrapper(queryClient);
+		const { result } = renderHook(() => useAuth(), { wrapper });
+
+		await waitFor(() => expect(result.current.ready).toBe(true));
+
+		expect(result.current.user).toBeUndefined();
+		expect(result.current.unavailable).toBe(true);
+		expect(queryClient.getQueryData(["cached-query"])).toEqual({ value: "kept" });
+	});
+
+	it("restores the session when retry succeeds after an outage", async () => {
+		let isOutage = true;
+		server.use(http.post("*/api/v1/auth/refresh", () =>
+			isOutage
+				? new HttpResponse(null, { status: 502 })
+				: HttpResponse.json({
+						accessToken: "restored-token",
+						user: { email: "user@example.com", id: "user-1" },
+					}),
+		));
+		const queryClient = createTestQueryClient();
+		const wrapper: FC<PropsWithChildren> = createAuthWrapper(queryClient);
+		const { result } = renderHook(() => useAuth(), { wrapper });
+
+		await waitFor(() => expect(result.current.unavailable).toBe(true));
+		isOutage = false;
+		act(() => result.current.retry());
+
+		await waitFor(() => expect(result.current.user?.id).toBe("user-1"));
+		expect(result.current.unavailable).toBe(false);
+		expect(await requestAuthorization()).toBe("Bearer restored-token");
+	});
+
+	it("keeps the original protected 401 and the session when serialized refresh has a transport error", async () => {
 		let refreshCalls = 0;
 		server.use(
 			http.post("*/api/v1/auth/refresh", () => {
@@ -137,10 +181,11 @@ describe("AuthProvider", () => {
 		const response = await apiClient.GET("/api/v1/brokerage-accounts");
 
 		expect(response.response.status).toBe(401);
-		await waitFor(() => expect(result.current.user).toBeUndefined());
-		expect(await requestAuthorization()).toBeNull();
-		expect(queryClient.getQueryData(["cached-query"])).toBeUndefined();
-		expect(queryClient.getQueryData(bankCardsKey)).toBeUndefined();
+		// An unreachable server does not prove the session ended; the next 401 refreshes again.
+		await waitFor(() => expect(result.current.unavailable).toBe(true));
+		expect(result.current.user?.id).toBe("user-1");
+		expect(queryClient.getQueryData(["cached-query"])).toEqual({ value: "stale" });
+		expect(queryClient.getQueryData(bankCardsKey)).toEqual([{ id: "bank-card-1" }]);
 	});
 
 	it("clears connection status and financial cache independently on logout", async () => {

src/features/auth/model/auth.vm.ts

@@ -5,6 +5,9 @@ import { apiClient, configureAuthClient, type paths } from "@/shared/api";
 
 import { type User } from "./auth-context";
 
+// A 5xx or network error means the server is unreachable, not that the session ended.
+const HTTP_SERVER_ERROR = 500;
+
 type Authentication
 	= paths["/api/v1/auth/login"]["post"]["responses"][200]["content"]["application/json"];
 
@@ -32,6 +35,8 @@ function useAuthProviderVm() {
 	const accessTokenRef = useRef<string | undefined>(undefined);
 	const [ready, setReady] = useState(false);
 	const [signedOut, setSignedOut] = useState(false);
+	const [unavailable, setUnavailable] = useState(false);
+	const unavailableRef = useRef(false);
 
 	const generationRef = useRef(0);
 	const userRef = useRef<undefined | User>(undefined);
@@ -49,12 +54,18 @@ function useAuthProviderVm() {
 		return next;
 	}, []);
 
+	const markUnavailable = useCallback((isUnavailable: boolean) => {
+		unavailableRef.current = isUnavailable;
+		setUnavailable(isUnavailable);
+	}, []);
+
 	const applyAuthentication = useCallback(
 		(authentication: Authentication) => {
 			const changedIdentity
 				= userRef.current && userRef.current.id !== authentication.user.id;
 
 			setSignedOut(false);
+			markUnavailable(false);
 			accessTokenRef.current = authentication.accessToken;
 
 			if (changedIdentity) {
@@ -67,16 +78,17 @@ function useAuthProviderVm() {
 			userRef.current = authentication.user;
 			setUser(authentication.user);
 		},
-		[queryClient],
+		[markUnavailable, queryClient],
 	);
 
 	const clearSession = useCallback(() => {
+		markUnavailable(false);
 		generationRef.current += 1;
 		userRef.current = undefined;
 		setUser(undefined);
 		accessTokenRef.current = undefined;
 		queryClient.clear();
-	}, [queryClient]);
+	}, [markUnavailable, queryClient]);
 
 	const refresh = useCallback((): Promise<boolean> => {
 		if (refreshPromiseRef.current) return refreshPromiseRef.current;
@@ -86,11 +98,12 @@ function useAuthProviderVm() {
 			if (started !== generationRef.current) return false;
 
 			try {
-				const { data } = await apiClient.POST("/api/v1/auth/refresh");
+				const { data, response } = await apiClient.POST("/api/v1/auth/refresh");
 				if (started !== generationRef.current) return false;
 
 				if (!data) {
-					clearSession();
+					if (response.status >= HTTP_SERVER_ERROR) markUnavailable(true);
+					else clearSession();
 
 					return false;
 				}
@@ -100,7 +113,7 @@ function useAuthProviderVm() {
 				return true;
 			}
 			catch {
-				if (started === generationRef.current) clearSession();
+				if (started === generationRef.current) markUnavailable(true);
 
 				return false;
 			}
@@ -112,7 +125,7 @@ function useAuthProviderVm() {
 		refreshPromiseRef.current = pending;
 
 		return pending;
-	}, [applyAuthentication, clearSession, serialize]);
+	}, [applyAuthentication, clearSession, markUnavailable, serialize]);
 
 	useEffect(() => {
 		void refresh().finally(() => setReady(true));
@@ -146,6 +159,7 @@ function useAuthProviderVm() {
 			clear: clearSession,
 			generation: () => generationRef.current,
 			refresh,
+			unavailable: () => unavailableRef.current,
 		});
 	});
 	useEffect(() => () => configureAuthClient(), []);
@@ -157,7 +171,9 @@ function useAuthProviderVm() {
 		ready,
 		register: (email: string, password: string) =>
 			authenticate("/api/v1/auth/register", email, password),
+		retry: () => void refresh(),
 		signedOut,
+		unavailable,
 		user,
 	};
 

src/features/auth/ui/AuthForm/AuthForm.test.tsx

@@ -30,4 +30,79 @@ describe("AuthForm", () => {
 		await waitFor(() => expect(onSubmit).not.toHaveBeenCalled());
 		expect(await screen.findByText("Пароли не совпадают")).toBeInTheDocument();
 	});
+
+	it.each([
+		["register", "Регистрация", "Уже есть аккаунт? Войти"],
+		["login", "Вход", "Нет аккаунта? Зарегистрироваться"],
+	])("blocks the switch-auth link while %s is submitting", async (_mode, submitLabel, linkLabel) => {
+		const { promise, resolve } = Promise.withResolvers<void>();
+		const onSubmit = vi.fn(() => promise);
+		render(
+			<MantineProvider>
+				<MemoryRouter>
+					<AuthForm
+						onSubmit={onSubmit}
+						register={_mode === "register"}
+					/>
+				</MemoryRouter>
+			</MantineProvider>,
+		);
+
+		fireEvent.change(screen.getByLabelText("Email"), {
+			target: { value: "user@example.com" },
+		});
+		fireEvent.change(screen.getByLabelText("Пароль"), {
+			target: { value: "a secure password" },
+		});
+
+		if (_mode === "register") {
+			fireEvent.change(screen.getByLabelText("Подтвердите пароль"), {
+				target: { value: "a secure password" },
+			});
+		}
+
+		fireEvent.click(screen.getByRole("button", { name: submitLabel }));
+
+		await waitFor(() => expect(onSubmit).toHaveBeenCalled());
+		expect(screen.queryByRole("link", { name: linkLabel })).not.toBeInTheDocument();
+		expect(screen.getByRole("button", { name: linkLabel })).toBeDisabled();
+
+		resolve();
+		await screen.findByRole("link", { name: linkLabel });
+	});
+
+	// Register policy is 8..72 printable ASCII; login accepts legacy passwords.
+	it.each([
+		["register", "Регистрация", "пароль-пароль", false],
+		["register", "Регистрация", "passw😀rd", false],
+		["register", "Регистрация", "a".repeat(7), false],
+		["register", "Регистрация", "a".repeat(8), true],
+		["register", "Регистрация", "a".repeat(72), true],
+		["register", "Регистрация", "a".repeat(73), false],
+		["login", "Вход", "пароль-пароль", true],
+	])("%s submits password %j: %s", async (mode, submitLabel, password, submitted) => {
+		const onSubmit = vi.fn().mockResolvedValue(undefined);
+
+		render(
+			<MantineProvider>
+				<MemoryRouter>
+					<AuthForm onSubmit={onSubmit} register={mode === "register"} />
+				</MemoryRouter>
+			</MantineProvider>,
+		);
+
+		fireEvent.change(screen.getByLabelText("Email"), { target: { value: "user@example.com" } });
+		fireEvent.change(screen.getByLabelText("Пароль"), { target: { value: password } });
+
+		if (mode === "register") {
+			fireEvent.change(screen.getByLabelText("Подтвердите пароль"), { target: { value: password } });
+		}
+
+		fireEvent.click(screen.getByRole("button", { name: submitLabel }));
+
+		await waitFor(() => expect(
+			screen.queryByText(/Пароль: от 8 до 72 символов/) === null,
+		).toBe(submitted));
+		expect(onSubmit).toHaveBeenCalledTimes(submitted ? 1 : 0);
+	});
 });

src/features/auth/ui/AuthForm/AuthForm.tsx

@@ -1,4 +1,4 @@
-import type { FC } from "react";
+import type { FC, ReactNode } from "react";
 
 import { zodResolver } from "@hookform/resolvers/zod";
 import { Alert, Button, Fieldset, PasswordInput, Stack, TextInput } from "@mantine/core";
@@ -15,7 +15,7 @@ import {
 
 type AuthFormProps = {
 	onSubmit: (email: string, password: string) => Promise<void>;
-	register?: true;
+	register?: boolean;
 };
 
 const AuthForm: FC<AuthFormProps> = (props) => {
@@ -45,6 +45,24 @@ const AuthForm: FC<AuthFormProps> = (props) => {
 	});
 
 	const to = register ? "/login" : "/register";
+	const switchLabel = t(register ? "auth.haveAccount" : "auth.noAccount");
+
+	let switchLink: ReactNode;
+
+	if (isSubmitting) {
+		switchLink = (
+			<Button aria-disabled disabled variant="subtle">
+				{switchLabel}
+			</Button>
+		);
+	}
+	else {
+		switchLink = (
+			<Button component={Link} to={to} variant="subtle">
+				{switchLabel}
+			</Button>
+		);
+	}
 
 	return (
 		<FormProvider {...methods}>
@@ -77,9 +95,7 @@ const AuthForm: FC<AuthFormProps> = (props) => {
 							{t(register ? "auth.register" : "auth.login")}
 						</Button>
 
-						<Button component={Link} to={to} variant="subtle">
-							{t(register ? "auth.haveAccount" : "auth.noAccount")}
-						</Button>
+						{switchLink}
 					</Stack>
 				</Fieldset>
 			</form>

src/features/tbank-connection/model/screen-sync.test.tsx

@@ -78,4 +78,35 @@ describe("read-only screen synchronization", () => {
 		await act(async () => result.current.refresh());
 		await waitFor(() => expect(gets).toBe(2));
 	});
+
+	it("does not manually refetch disabled resources", async () => {
+		vi.useFakeTimers();
+		const refetch = vi.fn(() => Promise.resolve());
+
+		const resource = {
+			isEnabled: false,
+			isError: true,
+			isFetching: false,
+			queryKey: [],
+			refetch,
+		};
+
+		try {
+			const { result, unmount } = renderHook(() =>
+				useScreenSync({ screen: "accounts" }, [resource]),
+			);
+
+			await act(async () => {
+				await result.current.refresh();
+				await result.current.retry();
+			});
+			await act(() => vi.advanceTimersByTime(1_800_000));
+
+			expect(refetch).not.toHaveBeenCalled();
+			unmount();
+		}
+		finally {
+			vi.useRealTimers();
+		}
+	});
 });

src/features/tbank-connection/model/screen-sync.ts

@@ -5,6 +5,7 @@ import { useEffect, useRef } from "react";
 import type { InvestmentResourceMeta } from "@/shared/api";
 
 type ScreenResource = {
+	isEnabled: boolean;
 	isError: boolean;
 	isFetching: boolean;
 	meta?: InvestmentResourceMeta;
@@ -27,23 +28,31 @@ function useScreenSync(_scope: ScreenScope, resources: ScreenResource[]) {
 
 	useEffect(() => {
 		const timer = setInterval(() => {
-			for (const resource of resourcesRef.current)
+			for (const resource of resourcesRef.current) {
+				if (!resource.isEnabled || resource.isFetching) continue;
 				void resource.refetch().catch(() => {});
+			}
 		}, READ_INTERVAL_MS);
 
 		return () => clearInterval(timer);
 	}, []);
 
-	const isRefreshing = resources.some(resource => resource.isFetching);
+	const isRefreshing = resources.some(
+		resource => resource.isEnabled && resource.isFetching,
+	);
+
+	const eligible = resources.filter(
+		resource => resource.isEnabled && !resource.isFetching,
+	);
 
 	const refresh = async () => {
 		if (isRefreshing) return;
-		await Promise.allSettled(resources.map(resource => resource.refetch()));
+		await Promise.allSettled(eligible.map(resource => resource.refetch()));
 	};
 
 	// Retry only the HTTP read; source attempts are reported in resource metadata.
 	const retry = async () => {
-		const failed = resources.filter(resource => resource.isError);
+		const failed = eligible.filter(resource => resource.isError);
 
 		if (failed.length > 0)
 			await Promise.allSettled(failed.map(resource => resource.refetch()));

src/pages/account-events/ui/AccountEventsPage/AccountEventsPage.filters.test.tsx

@@ -17,10 +17,10 @@ import {
 	useLocation,
 	useNavigate,
 } from "react-router";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { configureAuthClient } from "@/shared/api";
-import { defaultPeriod, formatDate } from "@/shared/lib";
+import { defaultPeriod, formatDate, moscowDate } from "@/shared/lib";
 import { createTestQueryClient } from "@/test/query";
 import { resource } from "@/test/resource";
 import { server } from "@/test/server";
@@ -72,7 +72,14 @@ function renderEvents(accountId: string, searches: string[]) {
 }
 
 describe("Upcoming event date filters", () => {
+	afterEach(() => {
+		vi.useRealTimers();
+	});
 	beforeEach(() => {
+		// Pin "today": the test picks today + 10 days, which must be inside the visible calendar grid.
+		// Real dates can push it beyond the grid (e.g. 2026-10-23 -> 2 November).
+		vi.useFakeTimers({ toFake: ["Date"] });
+		vi.setSystemTime(new Date("2026-08-10T09:00:00Z"));
 		configureAuthClient({
 			accessToken: () => "token",
 			clear: vi.fn(),
@@ -80,6 +87,8 @@ describe("Upcoming event date filters", () => {
 		});
 	});
 
+	afterEach(() => vi.useRealTimers());
+
 	it("keeps reads and sync disabled without an account scope", async () => {
 		const requests: string[] = [];
 		server.use(
@@ -229,6 +238,10 @@ describe("Upcoming event date filters", () => {
 	it.each(["account-1", "all"])(
 		"applies dates only on submit, restores URL dates, and resets from empty results for %s",
 		async (accountId) => {
+			// Pin "today" mid-month so "today + 10 days" stays in the calendar's
+			// visible month regardless of the real date.
+			vi.useFakeTimers({ toFake: ["Date"] });
+			vi.setSystemTime(new Date("2026-10-15T12:00:00+03:00"));
 			const [defaultFrom, defaultTo] = defaultPeriod();
 			const searches: string[] = [];
 			server.use(
@@ -253,37 +266,58 @@ describe("Upcoming event date filters", () => {
 			expect(from).toHaveTextContent("01.02.2026 – 28.02.2026");
 			expect(screen.getByRole("button", { name: "Применить" })).toBeDisabled();
 			expect(searches).toEqual(["?from=2026-02-01&to=2026-02-28"]);
-			fireEvent.click(from);
+
+			// The calendar opens on the applied month, so reset to the default
+			// range first, then pick today and a future date.
+			fireEvent.click(screen.getByRole("button", { name: "Сбросить" }));
+			await waitFor(() => expect(screen.getByLabelText("URL")).toBeEmptyDOMElement());
+			const picker = await screen.findByLabelText("Период");
+
+			const [today] = defaultPeriod();
+			const [year = 1970, month = 0, day = 1] = today.split("-").map(Number);
+
+			const future = moscowDate(new Date(
+				Date.UTC(year, month - 1, day + 10, 12),
+			));
+
+			// Mantine calendar labels follow dayjs default (English) locale.
+			const calendarLabel = (date: string) => {
+				const monthName = new Intl.DateTimeFormat("en", { month: "long" })
+					.format(new Date(`${date}T12:00:00Z`));
+
+				const pattern = `${Number(date.slice(8))} ${monthName} ${date.slice(0, 4)}`;
+
+				// Dates are constructed above from validated defaultPeriod output.
+				// eslint-disable-next-line security/detect-non-literal-regexp -- see comment above
+				return new RegExp(pattern, "i");
+			};
+
+			fireEvent.click(picker);
 			fireEvent.click(
-				await screen.findByRole("button", { name: /10 February 2026/i }),
+				await screen.findByRole("button", { name: calendarLabel(today) }),
 			);
 			fireEvent.click(
-				await screen.findByRole("button", { name: /28 February 2026/i }),
+				await screen.findByRole("button", { name: calendarLabel(future) }),
 			);
-			expect(searches).toHaveLength(1);
+			// The reset itself fetched the default range; picking dates applies only on submit.
+			expect(searches).toEqual([
+				"?from=2026-02-01&to=2026-02-28",
+				`?from=${defaultFrom}&to=${defaultTo}`,
+			]);
 			fireEvent.click(screen.getByRole("button", { name: "Применить" }));
 			await waitFor(() =>
-				expect(searches.at(-1)).toBe("?from=2026-02-10&to=2026-02-28"),
+				expect(searches.at(-1)).toBe(`?from=${today}&to=${future}`),
 			);
 			expect(await screen.findByLabelText("Период")).toHaveTextContent(
-				"10.02.2026 – 28.02.2026",
+				`${formatDate(today)} – ${formatDate(future)}`,
 			);
 			fireEvent.click(screen.getByRole("button", { name: "History back" }));
 			await waitFor(() =>
 				expect(screen.getByLabelText("Период")).toHaveTextContent(
-					"01.02.2026 – 28.02.2026",
+					`${formatDate(defaultFrom)} – ${formatDate(defaultTo)}`,
 				),
 			);
-			expect(screen.getByLabelText("URL")).toHaveTextContent(
-				"?from=2026-02-01&to=2026-02-28",
-			);
-			fireEvent.click(screen.getByRole("button", { name: "Сбросить" }));
-			await waitFor(() =>
-				expect(searches.at(-1)).toBe(`?from=${defaultFrom}&to=${defaultTo}`),
-			);
-			expect(await screen.findByLabelText("Период")).toHaveTextContent(
-				`${formatDate(defaultFrom)} – ${formatDate(defaultTo)}`,
-			);
+			expect(screen.getByLabelText("URL")).toBeEmptyDOMElement();
 			expect(screen.getByRole("button", { name: "Применить" })).toBeDisabled();
 			expect(
 				screen.getByText("За выбранный период событий не найдено"),

src/pages/account-events/ui/AccountEventsPage/AccountEventsPage.test.tsx

@@ -211,4 +211,30 @@ describe("AccountEventsPage", () => {
 		expect(status).toHaveAttribute("aria-busy", "true");
 		expect(within(status).queryByRole("button")).not.toBeInTheDocument();
 	});
+
+	it("keeps a null events envelope loading instead of an empty period", () => {
+		query.mockReturnValue(
+			{
+				data: null,
+				isError: false,
+				isLoading: false,
+				meta: {
+					availability: "available",
+					completeness: "complete",
+					lastAttempt: { finishedAt: null, problems: [], startedAt: null, state: "none" },
+				},
+				refetch: vi.fn(),
+			} as never,
+		);
+
+		renderPage();
+
+		expect(screen.getByRole("status", { name: "Загрузка" })).toHaveAttribute(
+			"aria-busy",
+			"true",
+		);
+		expect(
+			screen.queryByText("За выбранный период событий не найдено"),
+		).not.toBeInTheDocument();
+	});
 });

src/pages/account-events/ui/AccountEventsPage/AccountEventsPage.vm.ts

@@ -21,7 +21,7 @@ type AccountEventsPageViewModel
 		canApply: boolean;
 		draftPeriod: [null | string, null | string];
 		events: BrokerageEvent[];
-		maxDate: string;
+		minDate: string;
 		onApply: () => void;
 		onPeriodChange: (value: [null | string, null | string]) => void;
 		onPeriodPopoverOpen: () => void;
@@ -49,7 +49,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {
 
 	const [draftFrom, draftTo] = draftPeriod;
 
-	const [maxDate, setMaxDate] = useState(() => moscowDate(new Date()));
+	const [minDate, setMinDate] = useState(() => moscowDate(new Date()));
 
 	const scope = JSON.stringify([accountId, appliedFrom, appliedTo]);
 	const [previousScope, setPreviousScope] = useState(scope);
@@ -105,7 +105,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {
 			&& isValidPeriod(draftFrom, draftTo),
 		draftPeriod,
 		events: events.data.events,
-		maxDate,
+		minDate,
 		onApply: () => {
 			if (!isValidPeriod(draftFrom, draftTo)) return;
 			setSearchParameters({
@@ -116,7 +116,7 @@ function useAccountEventsPageViewModel(): AccountEventsPageViewModel {
 		onPeriodChange: value => setDraftPeriod(
 			value[0] === null && value[1] === null ? defaultPeriod() : value,
 		),
-		onPeriodPopoverOpen: () => setMaxDate(moscowDate(new Date())),
+		onPeriodPopoverOpen: () => setMinDate(moscowDate(new Date())),
 		onReset,
 		partial: events.meta?.completeness === "incomplete",
 		source: events.meta,

src/pages/account-events/ui/AccountEventsPage/components/AccountEventsPageLoaded.view.tsx

@@ -72,7 +72,7 @@ const AccountEventsPageLoaded: FC<AccountEventsPageLoadedProps> = (props) => {
 					clearable
 					clearButtonProps={{ "aria-label": t("ledger.clearPeriod") }}
 					label={t("ledger.period")}
-					maxDate={props.maxDate}
+					minDate={props.minDate}
 					onChange={props.onPeriodChange}
 					popoverProps={{
 						middlewares: { shift: { crossAxis: true } },

src/pages/account-income/ui/AccountIncomePage/AccountIncomePage.test.tsx

@@ -314,6 +314,24 @@ describe("AccountIncomePage", () => {
 		).not.toBeInTheDocument();
 	});
 
+	it("keeps a null analytics envelope loading instead of an empty page", async () => {
+		server.use(
+			http.get("*/api/v1/brokerage-accounts/account-1/income-analytics", () =>
+				HttpResponse.json(resource(null)),
+			),
+		);
+		renderPage();
+		expect(
+			await screen.findByRole("status", { name: "Загрузка" }, { timeout: 4000 }),
+		).toBeVisible();
+		expect(
+			screen.queryByRole("heading", { name: "Пассивный доход" }),
+		).not.toBeInTheDocument();
+		expect(
+			screen.queryByRole("button", { name: "Повторить" }),
+		).not.toBeInTheDocument();
+	});
+
 	it("renders the signed drill-down using opaque membership rather than instrument identity", async () => {
 		const response
 			= {

src/pages/account-operations/ui/AccountOperationsPage/AccountOperationsPage.test.tsx

@@ -492,6 +492,20 @@ describe("AccountOperationsPage", () => {
 			}),
 		).toBeInTheDocument();
 	});
+
+	it("keeps a null operations envelope loading instead of a confirmed empty period", async () => {
+		configureTestAuth();
+		server.use(
+			http.get("*/api/v1/brokerage-accounts/:accountId/operations", () =>
+				HttpResponse.json(resource(null)),
+			),
+		);
+		renderPage();
+		expect(
+			await screen.findByRole("status", { name: "Загрузка" }, { timeout: 4000 }),
+		).toBeVisible();
+		expect(screen.queryByText("Операций нет")).not.toBeInTheDocument();
+	});
 });
 
 it("keeps UTC operation boundaries in GET and source sync requests", async () => {

src/pages/account/ui/AccountPage/AccountPage.test.tsx

@@ -402,6 +402,50 @@ describe("AccountPage states", () => {
 		).toBeInTheDocument();
 	});
 
+	it("keeps a null portfolio envelope loading instead of an empty portfolio", async () => {
+		server.use(
+			http.get("*/api/v1/brokerage-accounts/:accountId/portfolio", () =>
+				HttpResponse.json(resource(null)),
+			),
+		);
+		const queryClient = createTestQueryClient();
+		renderAccountRoute(queryClient);
+
+		expect(
+			await screen.findByRole("status", { name: "Загрузка" }, { timeout: 4000 }),
+		).toBeVisible();
+		expect(screen.queryByText("Портфель пока пуст")).not.toBeInTheDocument();
+		expect(
+			queryClient.getQueryData(portfolioQueryOptions("account-1").queryKey),
+		).toMatchObject({ data: null });
+	});
+
+	it("keeps null events and income envelopes loading in the previews", async () => {
+		server.use(
+			http.get("*/api/v1/brokerage-accounts/:accountId/events", () =>
+				HttpResponse.json(resource(null)),
+			),
+			http.get("*/api/v1/brokerage-accounts/:accountId/income-summary", () =>
+				HttpResponse.json(resource(null)),
+			),
+		);
+		renderAccountRoute(createTestQueryClient());
+
+		expect(
+			await screen.findByText("Портфель пока пуст", undefined, {
+				timeout: 4000,
+			}),
+		).toBeVisible();
+		expect(
+			screen.getByRole("status", { name: "Загрузка будущих событий" }),
+		).toBeVisible();
+		expect(
+			screen.queryByText("На ближайшие 30 дней событий не найдено."),
+		).not.toBeInTheDocument();
+		expect(screen.getByText("Загрузка дохода текущего месяца")).toBeVisible();
+		expect(screen.queryByText("Нет текущих сумм")).not.toBeInTheDocument();
+	});
+
 	it("renders a stale portfolio in upstream order with nullable values hidden", () => {
 		renderPage(<AccountPageLoaded {...loadedProps()} />);
 

src/pages/bond/ui/BondPage/BondPage.test.tsx

@@ -88,7 +88,6 @@ const quote
 function setup(
 	options: {
 		ambiguousTicker?: boolean;
-		failBond?: boolean;
 		failCoupons?: boolean;
 		noPosition?: boolean;
 		path?: string;
@@ -100,11 +99,7 @@ function setup(
 	const resolved = { ...bond, slug: options.slug ?? uid };
 	let isFailQuote = false;
 	server.use(
-		http.get("*/api/v1/bonds/:uid", () =>
-			options.failBond
-				? HttpResponse.json({ code: "NOT_FOUND" }, { status: 404 })
-				: HttpResponse.json(resource(resolved)),
-		),
+		http.get("*/api/v1/bonds/:uid", () => HttpResponse.json(resource(resolved))),
 		http.get("*/api/v1/bonds/by-ticker/:ticker", ({ request }) => {
 			requests.push(new URL(request.url));
 

src/pages/card/ui/CardPage/CardHistory.view.tsx

@@ -17,6 +17,7 @@ import { useTranslation } from "react-i18next";
 import { Link } from "react-router";
 
 import {
+	BankFeedback,
 	bankOperationAppearance,
 } from "@/entities/bank-card";
 
@@ -108,6 +109,17 @@ const CardHistory: FC<CardHistoryProps> = (props) => {
 		return <Text>{t("bank.noOperations")}</Text>;
 	}
 
+	if (vm.history.error) {
+		return (
+			<BankFeedback
+				cached={Boolean(vm.rows)}
+				error={vm.history.error}
+				loadingError={!vm.rows}
+				retry={vm.history.refetch}
+			/>
+		);
+	}
+
 	if (vm.history.loading) {
 		return (
 			<LoadingSkeleton label={t("bank.loadingHistory")}>

src/pages/card/ui/CardPage/CardPage.test.tsx

@@ -316,12 +316,47 @@ describe("CardPage", () => {
 		setup({ summaryError: true });
 		await screen.findByRole("heading", { name: "Повседневная" });
 		expect(
-			screen.queryByRole("alert"),
-		).not.toBeInTheDocument();
+			await screen.findByText("Перевод на «Запасная»"),
+		).toBeInTheDocument();
+		expect(await screen.findByRole("alert", {}, { timeout: 5000 })).toHaveTextContent(
+			"Не удалось загрузить данные карт.",
+		);
+		expect(screen.queryByText("0 ₽")).not.toBeInTheDocument();
+	});
+
+	it("recovers summary with retry while keeping card and journal", async () => {
+		const { summaryRequests } = setup({ summaryError: true });
+		await screen.findByRole("heading", { name: "Повседневная" });
 		expect(
 			await screen.findByText("Перевод на «Запасная»"),
 		).toBeInTheDocument();
-		expect(screen.queryByText("0 ₽")).not.toBeInTheDocument();
+
+		const retry = await screen.findByRole(
+			"button",
+			{ name: "Повторить" },
+			{ timeout: 5000 },
+		);
+
+		const requestsBefore = summaryRequests.length;
+		server.use(
+			http.get("*/api/v1/bank-cards/summary", ({ request }) => {
+				summaryRequests.push(new URL(request.url).search);
+
+				return HttpResponse.json({
+					cardId: "a",
+					categories: [],
+					expenses: money("0"),
+					net: money("-50"),
+					refunds: money("50"),
+				});
+			}),
+		);
+		fireEvent.click(retry);
+
+		await waitFor(() =>
+			expect(screen.queryByRole("alert")).not.toBeInTheDocument(),
+		);
+		expect(summaryRequests).toHaveLength(requestsBefore + 1);
 	});
 	it("keeps cached card and history after refetch failure", async () => {
 		const { client } = setup();
@@ -331,9 +366,8 @@ describe("CardPage", () => {
 			http.get("*/api/v1/bank-cards/a/operations", () => HttpResponse.error()),
 		);
 		await client.invalidateQueries();
-		await waitFor(() => {
-			expect(screen.queryByRole("alert")).not.toBeInTheDocument();
-		});
+		const alerts = await screen.findAllByRole("alert", {}, { timeout: 5000 });
+		expect(alerts.length).toBeGreaterThanOrEqual(1);
 		expect(
 			screen.getByRole("heading", { name: "Повседневная" }),
 		).toBeInTheDocument();
@@ -401,11 +435,11 @@ describe("CardPage", () => {
 		]);
 	});
 	it("recovers the prerequisite card list while preserving the visible balance and journal", async () => {
-		setup({ cardsError: true });
+		const { client } = setup({ cardsError: true });
 		await screen.findByText("Перевод на «Запасная»");
 		expect(
-			screen.queryByRole("alert"),
-		).not.toBeInTheDocument();
+			await screen.findByRole("alert", {}, { timeout: 5000 }),
+		).toHaveTextContent("Не удалось загрузить данные карт.");
 		expect(
 			screen.getByRole("button", { name: "Добавить операцию" }),
 		).toBeDisabled();
@@ -414,6 +448,7 @@ describe("CardPage", () => {
 				HttpResponse.json([card, { ...card, id: "b", name: "Запасная" }]),
 			),
 		);
+		await client.invalidateQueries();
 		await waitFor(() =>
 			expect(
 				screen.getByRole("button", { name: "Добавить операцию" }),

src/pages/card/ui/CardPage/CardPage.view.tsx

@@ -75,6 +75,11 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 							{t("bank.back")}
 						</Button>
 
+						{!vm.notFound && (
+							<Button onClick={vm.cardRetry} variant="default">
+								{t("bank.retry")}
+							</Button>
+						)}
 					</Group>
 				)}
 				error
@@ -128,18 +133,27 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 				)}
 
 				{card.archivedAt && <Text>{t("bank.archiveHint")}</Text>}
+
+				{vm.cardError && vm.card && (
+					<BankFeedback
+						cached
+						error={vm.cardError}
+						retry={vm.cardRetry}
+					/>
+				)}
 			</Stack>
 
 			{vm.cardsFeedback && (
 				<BankFeedback
 					{...vm.cardsFeedback}
 					loadingError
+					retry={vm.cardsRetry}
 				/>
 			)}
 
 			<BankPeriodPicker onChange={vm.setPeriod} period={vm.period} />
 
-			<BankSummaryView {...vm.summary} />
+			<BankSummaryView {...vm.summary} retry={vm.summary.refetch} />
 
 			<Group align="end" justify="space-between">
 				<Group gap="xs">
@@ -183,8 +197,6 @@ const CardPageView: FC<CardPageViewProps> = (props) => {
 				<CardHistory history={vm.history} period={vm.period} rows={vm.rows} />
 			</Stack>
 
-			{vm.history.error && !vm.rows && <Text role="alert">{t("bank.error")}</Text>}
-
 			{vm.history.page !== undefined && vm.pageSize !== "all" && (
 				<Group
 					aria-label={t("bank.pagination")}

src/pages/card/ui/CardPage/CardPage.vm.ts

@@ -97,13 +97,16 @@ function useCardPageVm() {
 		archivePending: updateCard.isPending,
 		canAddOperation: !card.data?.archivedAt && Boolean(cards.data),
 		card: card.data,
+		cardError: card.error,
 		cardLoading: card.isLoading,
 		cardRefreshError: card.isError,
 		cardRefreshing: card.isFetching,
+		cardRetry: () => card.refetch(),
 		cards: cards.data,
 		cardsFeedback: cards.isError
 			? { cached: Boolean(cards.data), error: cards.error }
 			: undefined,
+		cardsRetry: () => cards.refetch(),
 		closeDeletion: () => setDeleting(null),
 		closeEditing: () => setEditingCard(false),
 		closeOperation: () => setOperation(null),
@@ -112,9 +115,10 @@ function useCardPageVm() {
 		editingCard,
 		history: {
 			changingPage: history.isPlaceholderData,
-			error: history.isError,
+			error: history.error,
 			loading: history.isLoading,
 			page: history.data?.page,
+			refetch: () => history.refetch(),
 		},
 		notFound: isApiErrorCode(
 			apiErrorCode(card.error),
@@ -139,9 +143,10 @@ function useCardPageVm() {
 		},
 		summary: {
 			data: summary.data,
-			error: summary.isError,
+			error: summary.error,
 			fetching: summary.isFetching,
 			loading: summary.isLoading,
+			refetch: () => summary.refetch(),
 		},
 		toggleArchive: () => {
 			if (!card.data) return;

src/pages/cards/ui/CardsPage/CardsPage.test.tsx

@@ -47,8 +47,9 @@ function renderCards(isFail = false, hasCategoryFailure = false) {
 		),
 	);
 
-	return render(
-		<QueryClientProvider client={createTestQueryClient()}>
+	const client = createTestQueryClient();
+	render(
+		<QueryClientProvider client={client}>
 			<MantineProvider env="test">
 				<MemoryRouter initialEntries={["/cards?month=2026-09"]}>
 					<CardsPage />
@@ -56,6 +57,8 @@ function renderCards(isFail = false, hasCategoryFailure = false) {
 			</MantineProvider>
 		</QueryClientProvider>,
 	);
+
+	return client;
 }
 
 describe("CardsPage", () => {
@@ -232,4 +235,76 @@ describe("CardsPage", () => {
 		});
 		expect(screen.queryByRole("alert")).not.toBeInTheDocument();
 	});
+
+	it("shows a cold cards error with retry", async () => {
+		renderCards(true);
+
+		expect(
+			await screen.findByRole("alert", {}, { timeout: 5000 }),
+		).toHaveTextContent("Не удалось загрузить данные карт.");
+		expect(
+			screen.getByRole("button", { name: "Повторить" }),
+		).toBeInTheDocument();
+
+		server.use(
+			http.get("*/api/v1/bank-cards", () =>
+				HttpResponse.json([
+					{
+						archivedAt: null,
+						balance: money("10000"),
+						bankName: null,
+						id: "a",
+						lastFour: null,
+						name: "Повседневная",
+						openingBalance: money("10000"),
+						openingDate: "2026-01-01",
+						version: 1,
+					},
+				]),
+			),
+		);
+		fireEvent.click(screen.getByRole("button", { name: "Повторить" }));
+
+		await waitFor(() =>
+			expect(screen.queryByRole("alert")).not.toBeInTheDocument(),
+		);
+		expect(
+			screen.getByRole("link", { name: /Повседневная/ }),
+		).toBeInTheDocument();
+	});
+
+	it("shows a cached cards error while keeping the grid", async () => {
+		const view = renderCards();
+
+		await screen.findByRole("heading", { name: "Добавьте первую карту" });
+		server.use(
+			http.get("*/api/v1/bank-cards", () =>
+				HttpResponse.json([
+					{
+						archivedAt: null,
+						balance: money("10000"),
+						bankName: null,
+						id: "a",
+						lastFour: null,
+						name: "Повседневная",
+						openingBalance: money("10000"),
+						openingDate: "2026-01-01",
+						version: 1,
+					},
+				]),
+			),
+		);
+		await view.invalidateQueries();
+		await screen.findByRole("link", { name: /Повседневная/ });
+
+		server.use(http.get("*/api/v1/bank-cards", () => HttpResponse.error()));
+		await view.invalidateQueries();
+
+		expect(
+			await screen.findByRole("alert", {}, { timeout: 5000 }),
+		).toHaveTextContent("Не удалось обновить данные. Показаны последние полученные.");
+		expect(
+			screen.getByRole("link", { name: /Повседневная/ }),
+		).toBeInTheDocument();
+	});
 });

src/pages/cards/ui/CardsPage/CardsPage.view.tsx

@@ -18,6 +18,7 @@ import { Link } from "react-router";
 
 import {
 	BankCardFace,
+	BankFeedback,
 	BankPeriodPicker,
 	BankSummaryView,
 } from "@/entities/bank-card";
@@ -51,15 +52,17 @@ const CardsPageViewCards: FC<CardsPageViewProps> = (props) => {
 			);
 		}
 
-		const text = t(vm.archive ? "bank.emptyHint" : "bank.noActive");
+		if (!vm.cards.error) {
+			const text = t(vm.archive ? "bank.emptyHint" : "bank.noActive");
 
-		return (
-			<StateView
-				action={<Button onClick={vm.onAddCard}>{t("bank.addCard")}</Button>}
-				text={text}
-				title={t("bank.empty")}
-			/>
-		);
+			return (
+				<StateView
+					action={<Button onClick={vm.onAddCard}>{t("bank.addCard")}</Button>}
+					text={text}
+					title={t("bank.empty")}
+				/>
+			);
+		}
 	}
 
 	if (vm.cards.isLoading) {
@@ -103,6 +106,15 @@ const CardsPageView: FC<CardsPageViewProps> = (props) => {
 				onChange={vm.onArchiveChange}
 			/>
 
+			{vm.cards.error && (
+				<BankFeedback
+					cached={Boolean(vm.cards.data)}
+					error={vm.cards.error}
+					loadingError={!vm.cards.data}
+					retry={vm.retryCards}
+				/>
+			)}
+
 			<CardsPageViewCards {...props} />
 
 			<Group align="flex-end" justify="space-between">
@@ -123,9 +135,10 @@ const CardsPageView: FC<CardsPageViewProps> = (props) => {
 			<BankSummaryView
 				all
 				data={vm.summary.data}
-				error={vm.summary.isError}
+				error={vm.summary.error}
 				fetching={vm.summary.isFetching}
 				loading={vm.summary.isLoading}
+				retry={vm.retrySummary}
 			/>
 		</Stack>
 	);

src/pages/cards/ui/CardsPage/CardsPage.vm.ts

@@ -39,6 +39,8 @@ function useCardsPageVm() {
 			setArchive(event.currentTarget.checked),
 		onCategories: () => setManagingCategories(true),
 		period,
+		retryCards: () => cards.refetch(),
+		retrySummary: () => summary.refetch(),
 		setPeriod: (value: [null | string, null | string]) => {
 			if (value[0] && value[1]) setParameters({ from: value[0], to: value[1] });
 		},

src/pages/stock/ui/StockPage/StockPage.test.tsx

@@ -413,7 +413,9 @@ describe("stock page", () => {
 		expect(await screen.findByText("Продажа")).toBeVisible();
 		expect(screen.getByText("2 шт.")).toBeVisible();
 		expect(screen.getByText("Цена: 100 ₽")).toBeVisible();
-		expect(screen.getByText(/02.01.2022, 10:00 UTC/)).toBeVisible();
+		const snapshotTime = new Intl.DateTimeFormat("ru-RU", { dateStyle: "short", timeStyle: "short" });
+		const operationTime = snapshotTime.format(new Date("2022-01-02T10:00:00Z"));
+		expect(screen.getByText(operationTime, { exact: false })).toBeVisible();
 		expect(
 			requests.some(
 				url =>

src/pages/stocks/ui/StocksPage/StocksPage.test.tsx

@@ -1,6 +1,6 @@
 import { MantineProvider } from "@mantine/core";
 import { QueryClientProvider } from "@tanstack/react-query";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { http, HttpResponse } from "msw";
 import { MemoryRouter } from "react-router";
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -12,19 +12,37 @@ import { server } from "@/test/server";
 import { StocksPage } from "./StocksPage";
 import { useStocksPageVm } from "./StocksPage.vm";
 
+const pageOperations: Promise<void>[] = [];
+
 const StocksPageVmProbe = () => {
 	const vm = useStocksPageVm();
 
 	return (
 		<>
-			<button onClick={vm.onSearch}>search</button>
-			<button onClick={() => vm.onPage(2)}>page</button>
+			<button
+				onClick={() => {
+					pageOperations.push(vm.search());
+				}}
+			>
+				search
+			</button>
+			<button
+				onClick={() => {
+					pageOperations.push(vm.changePage(2));
+				}}
+			>
+				page
+			</button>
 			<output>{vm.items.map(item => item.name).join(", ")}</output>
 		</>
 	);
 };
 
-afterEach(() => vi.useRealTimers());
+afterEach(() => {
+	pageOperations.length = 0;
+
+	return vi.useRealTimers();
+});
 
 describe("stock search", () => {
 	it("waits for a meaningful query and uses the server-verified ticker link", async () => {
@@ -75,7 +93,9 @@ describe("stock search", () => {
 		expect(
 			await screen.findByRole("link", { name: /Сбербанк/ }),
 		).toHaveAttribute("href", "/stocks/e6123145-9665-43e0-8413-cd61b8aa9b13");
-		expect(screen.getByText("Список получен 10.10.2026, 10:00")).toBeVisible();
+		const snapshotTime = new Intl.DateTimeFormat("ru-RU", { dateStyle: "short", timeStyle: "short" });
+		const fetchedAt = snapshotTime.format(new Date("2026-10-10T10:00:00Z"));
+		expect(screen.getByText(`Список получен ${fetchedAt}`)).toBeVisible();
 		expect(screen.getByText("Лот: 10 шт.")).toBeVisible();
 		expect(screen.getByText("ISIN: RU0009029540")).toBeVisible();
 		expect(screen.getAllByText("Мосбиржа")[0]).toBeVisible();
@@ -230,9 +250,12 @@ describe("stock search", () => {
 		fireEvent.click(screen.getByRole("button", { name: "page" }));
 		fireEvent.click(screen.getByRole("button", { name: "search" }));
 		await screen.findByText("Новый");
-		oldPage.resolve();
+		await act(async () => {
+			oldPage.resolve();
+			await pageOperations[0];
+		});
 
-		await waitFor(() => expect(screen.getByText("Новый")).toBeVisible());
+		expect(screen.getByText("Новый")).toBeVisible();
 		expect(screen.queryByText("Старый результат")).not.toBeInTheDocument();
 	});
 

src/pages/stocks/ui/StocksPage/StocksPage.vm.ts

@@ -101,6 +101,7 @@ function useStocksPageVm() {
 	};
 
 	return {
+		changePage,
 		criteria,
 		error,
 		items: page?.items ?? [],
@@ -111,6 +112,8 @@ function useStocksPageVm() {
 		onSearch: () => void search(),
 		page: page?.page,
 		resultTime: page?.asOf,
+		// Test seam: settle the actual operation instead of the handler release.
+		search,
 		searched: page !== null,
 		totalPages: page ? page.page + Number(page.hasNext) : 0,
 	};

src/shared/api/client.test.ts

@@ -67,6 +67,25 @@ describe("apiClient authentication", () => {
 		expect(clear).toHaveBeenCalledOnce();
 	});
 
+	it("keeps the session when refresh failed because the server was unreachable", async () => {
+		const clear = vi.fn();
+		server.use(
+			http.get("*/api/v1/brokerage-accounts", () =>
+				HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 }),
+			),
+		);
+		configureAuthClient({
+			accessToken: () => "expired",
+			clear,
+			refresh: () => Promise.resolve(false),
+			unavailable: () => true,
+		});
+
+		await apiClient.GET("/api/v1/brokerage-accounts");
+
+		expect(clear).not.toHaveBeenCalled();
+	});
+
 	it("does not attach Bearer auth to authentication endpoints", async () => {
 		let authorization: null | string
 
@@ -281,6 +300,33 @@ describe("apiClient transient read recovery", () => {
 		},
 	);
 
+	it("does not retry a read refused with INVALID_TBANK_TOKEN", async () => {
+		let requests = 0;
+		server.use(
+			http.get("*/api/v1/brokerage-accounts", () => {
+				requests += 1;
+
+				return HttpResponse.json(
+					{ code: "INVALID_TBANK_TOKEN", status: 400 },
+					{ status: 400 },
+				);
+			}),
+		);
+		configureAuthClient({
+			accessToken: () => "token",
+			clear: vi.fn(),
+			refresh: () => Promise.resolve(false),
+		});
+
+		const { error, response } = await apiClient.GET(
+			"/api/v1/brokerage-accounts",
+		);
+
+		expect(response.status).toBe(400);
+		expect(error).toMatchObject({ code: "INVALID_TBANK_TOKEN" });
+		expect(requests).toBe(1);
+	});
+
 	it("does not retry mutations", async () => {
 		let requests = 0;
 		server.use(

src/shared/api/client.ts

@@ -32,6 +32,10 @@ type AuthHandlers = {
 	clear: () => void;
 	generation?: () => number;
 	refresh: () => Promise<boolean>;
+	/**
+	True after a refresh failed transiently (network/5xx): the session is not proven gone.
+	*/
+	unavailable?: () => boolean;
 };
 
 type ReadAttempt = {
@@ -100,7 +104,8 @@ async function authenticatedFetch(request: Request): Promise<Response> {
 	if (!isCurrent()) throw new DOMException("Session changed", "AbortError");
 
 	if (!(await sessionState.handlers.refresh())) {
-		if (isCurrent()) sessionState.handlers.clear();
+		if (isCurrent() && !sessionState.handlers.unavailable?.())
+			sessionState.handlers.clear();
 
 		return response;
 	}

src/shared/api/generated/schema.d.ts

@@ -746,10 +746,13 @@ export interface components {
                 detail: string;
             }[];
         };
-        CredentialsDto: {
+        RegisterDto: {
             /** @example user@example.com */
             email: string;
-            /** @example a secure password */
+            /**
+             * @description Raw password: 8-72 printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.
+             * @example a secure password
+             */
             password: string;
         };
         UserDto: {
@@ -760,6 +763,15 @@ export interface components {
             accessToken: string;
             user: components["schemas"]["UserDto"];
         };
+        LoginDto: {
+            /** @example user@example.com */
+            email: string;
+            /**
+             * @description Raw password, at most 72 UTF-8 bytes. Not trimmed or normalized.
+             * @example a secure password
+             */
+            password: string;
+        };
         MoneyDto: {
             currency: string;
             value: string;
@@ -1708,7 +1720,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CredentialsDto"];
+                "application/json": components["schemas"]["RegisterDto"];
             };
         };
         responses: {
@@ -1776,7 +1788,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CredentialsDto"];
+                "application/json": components["schemas"]["LoginDto"];
             };
         };
         responses: {

src/shared/api/resource-query.test.tsx

@@ -164,10 +164,16 @@ describe("persistent resource query lifecycle", () => {
 		});
 
 		await waitFor(() => expect(isStarted).toBe(true));
-		await act(() => result.current.observe());
+		// Capture the observation promise before releasing the old handler; the
+		// final assertion must follow its settlement, not the handler release.
+		let observation: Promise<unknown> = Promise.resolve();
+		await act(async () => {
+			observation = result.current.observe() ?? Promise.resolve();
+			await observation;
+		});
 		await act(async () => {
 			release();
-			await blocked;
+			await observation;
 		});
 		expect(result.current.data).toEqual(snapshot);
 	});

src/shared/api/spec/openapi.json

@@ -10,7 +10,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CredentialsDto"
+                "$ref": "#/components/schemas/RegisterDto"
               }
             }
           }
@@ -91,7 +91,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CredentialsDto"
+                "$ref": "#/components/schemas/LoginDto"
               }
             }
           }
@@ -5236,7 +5236,7 @@
           "code"
         ]
       },
-      "CredentialsDto": {
+      "RegisterDto": {
         "type": "object",
         "properties": {
           "email": {
@@ -5245,8 +5245,8 @@
           },
           "password": {
             "type": "string",
-            "minLength": 12,
-            "maxLength": 72,
+            "description": "Raw password: 8-72 printable ASCII characters (letters, digits, symbols, space). Not trimmed or normalized.",
+            "pattern": "^[\\x20-\\x7E]{8,72}$",
             "example": "a secure password"
           }
         },
@@ -5285,6 +5285,24 @@
           "user"
         ]
       },
+      "LoginDto": {
+        "type": "object",
+        "properties": {
+          "email": {
+            "type": "string",
+            "example": "user@example.com"
+          },
+          "password": {
+            "type": "string",
+            "description": "Raw password, at most 72 UTF-8 bytes. Not trimmed or normalized.",
+            "example": "a secure password"
+          }
+        },
+        "required": [
+          "email",
+          "password"
+        ]
+      },
       "MoneyDto": {
         "type": "object",
         "properties": {
@@ -7460,7 +7478,8 @@
             "type": "integer",
             "minimum": 1
           }
-        }
+        },
+        "additionalProperties": false
       },
       "StockScreenerItemDto": {
         "type": "object",
@@ -7506,7 +7525,8 @@
           },
           "lot": {
             "type": "integer",
-            "nullable": true
+            "nullable": true,
+            "minimum": 1
           }
         },
         "required": [

src/shared/i18n/locales/ru.ts

@@ -53,10 +53,14 @@ const ru = {
 			passwordConfirmation: "Подтвердите пароль",
 			register: "Регистрация",
 			requestError: "Не удалось выполнить запрос. Попробуйте ещё раз.",
+			retry: "Повторить",
+			unavailableText: "Сервер временно недоступен. Ваш вход сохранён, попробуйте через минуту.",
+			unavailableTitle: "Не удалось подключиться",
 			validation: {
 				invalidEmail: "Некорректный email",
-				invalidPasswordLength: "Пароль должен содержать от 12 до 72 байт",
+				invalidPasswordLength: "Пароль: от 8 до 72 символов, только латинские буквы, цифры, спецсимволы и пробел",
 				passwordsDoNotMatch: "Пароли не совпадают",
+				passwordTooLong: "Пароль не должен превышать 72 байта",
 			},
 		},
 		bank: {
@@ -416,7 +420,7 @@ const ru = {
 			next: "Далее",
 			noInstrument: "Без инструмента",
 			noMoney: "Без движения денег",
-			occurredAt: "{{date}} UTC",
+			occurredAt: "{{date}}",
 			open: "Открыть журнал",
 			operationType: {
 				buy: "Покупка",
@@ -628,7 +632,7 @@ const ru = {
 			position: "Моя позиция",
 			previous: "Назад",
 			price: "Цена",
-			priceAt: "Цена на {{date}} UTC",
+			priceAt: "Цена на {{date}}",
 			priceTable: "Цены в таблице",
 			priceTableHint: "Дневные закрытия · записей: {{count}} · сначала новые",
 			priceUnavailable: "Цена недоступна",
@@ -717,7 +721,7 @@ const ru = {
 				SHARE_TYPE_GDR: "Депозитарная расписка",
 				SHARE_TYPE_PREFERRED: "Привилегированная акция",
 			},
-			snapshotAt: "Позиция на {{date}} UTC",
+			snapshotAt: "Позиция на {{date}}",
 			trading: {
 				SECURITY_TRADING_STATUS_BREAK_IN_TRADING: "Перерыв в торгах",
 				SECURITY_TRADING_STATUS_CLOSING_AUCTION: "Аукцион закрытия",

src/shared/lib/calendar.test.ts

@@ -38,11 +38,11 @@ describe("calendar dates", () => {
 		expect(moscowDate(new Date("2026-12-31T21:00:00Z"))).toBe("2027-01-01");
 	});
 
-	it("defaults to the last 7 days including today", () => {
+	it("defaults to 7 calendar dates starting with today", () => {
 		const [from, to] = defaultPeriod();
 
 		expect(calendarDate.safeParse(from).success).toBe(true);
-		expect(to).toBe(moscowDate(new Date()));
+		expect(from).toBe(moscowDate(new Date()));
 		expect((Date.parse(to) - Date.parse(from)) / 86_400_000).toBe(6);
 		expect(from <= to).toBe(true);
 	});

src/shared/lib/calendar.ts

@@ -9,8 +9,7 @@ function isValidPeriod(from: null | string, to: null | string) {
 	);
 }
 
-const DAY_MS = 86_400_000;
-const DEFAULT_PERIOD_DAYS = 6;
+const DEFAULT_PERIOD_LAST_INDEX = 6;
 
 const moscowFormatter = new Intl.DateTimeFormat("en-CA", {
 	day: "2-digit",
@@ -25,12 +24,17 @@ function compareDateDesc(a: null | string, b: null | string) {
 	return (b ?? "").localeCompare(a ?? "");
 }
 
-// Last 7 days including today. An empty period always means this range.
+// 7 calendar dates starting with today (Moscow calendar arithmetic).
 function defaultPeriod(): [string, string] {
-	const to = new Date();
-	const from = new Date(to.getTime() - DEFAULT_PERIOD_DAYS * DAY_MS);
+	const from = moscowDate(new Date());
 
-	return [moscowDate(from), moscowDate(to)];
+	const [year = 1970, month = 0, day = 1] = from.split("-").map(Number);
+	const noon = 12;
+	const lastDay = day + DEFAULT_PERIOD_LAST_INDEX;
+	const end = new Date(Date.UTC(year, month - 1, lastDay, noon));
+	const to = moscowDate(end);
+
+	return [from, to];
 }
 
 function moscowDate(value: Date): string {

src/shared/lib/display.test.ts

@@ -12,9 +12,16 @@ describe("shared display helpers", () => {
 		expect(formatDate("2027-09-10")).toBe("10.09.2027");
 		expect(formatDate("2024-02-29")).toBe("29.02.2024");
 		expect(formatDate("2027-09-10T00:30:00+03:00")).toBe("09.09.2027");
-		expect(formatSnapshotTime("2027-09-10T00:30:00+03:00")).toBe(
-			"09.09.2027, 21:30",
-		);
+	});
+	it("formats snapshot time in the browser time zone", () => {
+		const instant = "2027-09-10T00:30:00+03:00";
+
+		const expected = new Intl.DateTimeFormat("ru-RU", {
+			dateStyle: "short",
+			timeStyle: "short",
+		}).format(new Date(instant));
+
+		expect(formatSnapshotTime(instant)).toBe(expected);
 	});
 	it("formats decimal strings without financial arithmetic", () => {
 		expect(formatMoney({ currency: "RUB", value: "-1234567.89" })).toBe(

src/shared/lib/display.ts

@@ -61,10 +61,10 @@ function formatMoney(
 	return `${formatDecimal(decimal)} ${currency}`;
 }
 
+// Без timeZone Intl берёт часовой пояс браузера пользователя.
 const snapshotFormatter = new Intl.DateTimeFormat("ru-RU", {
 	dateStyle: "short",
 	timeStyle: "short",
-	timeZone: "UTC",
 });
 
 function formatSnapshotTime(value: string): string {