diff --git a/.agents/skills/macro-private-maintainer/SKILL.md b/.agents/skills/macro-private-maintainer/SKILL.md
index 66eb7089b43..104a8acebad 100644
--- a/.agents/skills/macro-private-maintainer/SKILL.md
+++ b/.agents/skills/macro-private-maintainer/SKILL.md
@@ -78,6 +78,11 @@ description: Master orchestration skill for maintaining, auditing, developing, a
 4. **修改优先级原则**：配置 > 环境变量 > Adapter 替换 > 依赖注入 > 反代 Proxy > 小范围 Patch > 修改 Domain。
 5. **凭据安全红线**：严禁在 Git 追踪的文件中硬编码真实服务器 IP、私钥、OAuth Secret 或 API Key。
 6. **UI 设计系统一致性**：前端二开必须复用 Macro 官方 `@ui`、Kobalte primitives、Theme 语义 Token、既有字号与动效语言；禁止建立平行组件库、私有颜色体系、任意字号或无障碍不受控的自定义交互。
+7. **上游/二开归因先行**：处理 CI、lint、typecheck、构建失败或 warning 前，先用 `git diff upstream/main -- <path>`、`git show upstream/main:<path>`、现有 workflow/just 脚本确认问题来源。结论必须区分：`上游已有`、`二开新增`、`二开触发上游隐患`。
+8. **上游非阻断问题不主动改**：若 lint / type / test 输出来自 `upstream/main` 已存在的问题，且不影响当前构建、CI 门禁、生产运行或本次二开目标，只记录来源与风险，不为“清爽”而修改上游代码。避免把私有 fork 变成无关风格修复分支，增加后续 upstream merge 成本。
+9. **二开代码必须贴合上游规范**：凡是本 fork 新增或本次触碰的二开代码，必须按上游现有目录边界、类型模型、query/service-client 分层、UI 组件规范、格式化与 lint 规则实现。若二开触发 warning/error，优先通过对齐上游模式修复；不要靠禁用规则、扩大类型、粗暴 cast、复制业务逻辑或改原始上游脚本来绕过。
+10. **上游原生运维入口优先**：遇到生产/本地环境状态漂移、服务初始化顺序、外部系统配置缺失、IaC 未落地、数据库/FusionAuth/LocalStack/OpenSearch/Redis/Kafka 等运行时状态不一致时，先查仓库原生脚本、Just recipes、Pulumi/Terraform/IaC 栈、Docker Compose、迁移与 README，再判断是否为“脚本未执行 / import 未完成 / reconcile 未覆盖”。禁止先写新的旁路补丁、手工 curl 脚本或业务代码兜底来掩盖漂移。
+11. **优先贴近 upstream 处理方式**：凡是 Macro 上游已有部署、初始化、导入、同步、回填、修复、seed、doctor、drift check、reconcile 等机制，优先复用或补齐调用路径；只有确认上游没有覆盖当前私有化场景时，才新增最小私有化封装，并明确标注原因与边界。
 
 ---
 
diff --git a/.agents/skills/macro-private-maintainer/skills/macro-local-environment/SKILL.md b/.agents/skills/macro-private-maintainer/skills/macro-local-environment/SKILL.md
index 31cdc2c35b3..b4b3d90cde2 100644
--- a/.agents/skills/macro-private-maintainer/skills/macro-local-environment/SKILL.md
+++ b/.agents/skills/macro-private-maintainer/skills/macro-local-environment/SKILL.md
@@ -128,6 +128,8 @@ just stack down
 - Do not treat local DEV success as production or CI parity.
 - Use CodeGraph for symbol/call relationship analysis when `.codegraph/` exists.
 - Use Cargo/Nix/Compose graphs for build dependency analysis instead of guessing from filenames.
+- For runtime state drift such as missing FusionAuth IdPs, stale LocalStack resources, missing queues, stale Docker volumes, missing seeded roles, or service config that exists in code but not in the running environment, inspect upstream-native repo mechanisms first: `just` recipes, `xtask_local`, Pulumi stacks, Docker Compose, migrations, seed tools, README runbooks, and existing doctor/status commands. Prefer restoring the intended upstream/IaC reconcile path over adding one-off curl patches or business-code fallbacks.
+- For CI parity checks, distinguish upstream-existing warnings from fork-introduced failures before editing. If a warning exists on `upstream/main` and does not fail the current gate, report it without changing upstream code. Fix fork-introduced errors/warnings by following the upstream file's existing patterns and boundaries.
 
 ## References
 
diff --git a/.fork/customizations.yml b/.fork/customizations.yml
index 44041186c07..ed03dd864c0 100644
--- a/.fork/customizations.yml
+++ b/.fork/customizations.yml
@@ -42,6 +42,8 @@ customizations:
       - crates/macro_db_client/**
       - crates/macro_db_migrator/**
       - self-host/init/**
+      - apps/web/src/features/auth/EmailForm.tsx
+      - apps/web/src/features/auth/Login.tsx
     tests:
       - conventions
       - auth-rust
diff --git a/.github/workflows/validate-service-cache.yml b/.github/workflows/validate-service-cache.yml
index 30844ab7ecf..5b6d965f0df 100644
--- a/.github/workflows/validate-service-cache.yml
+++ b/.github/workflows/validate-service-cache.yml
@@ -1,9 +1,6 @@
 name: Validate service cache planner
 
 on:
-  push:
-    branches:
-      - build/service-cache-20260906
   pull_request:
     branches:
       - main
diff --git a/apps/web/src/components/app/app-sidebar/sidebar.tsx b/apps/web/src/components/app/app-sidebar/sidebar.tsx
index e4d36ccd9ae..46ed8ce1629 100644
--- a/apps/web/src/components/app/app-sidebar/sidebar.tsx
+++ b/apps/web/src/components/app/app-sidebar/sidebar.tsx
@@ -167,7 +167,7 @@ const DEFAULT_TRY_VISIBILITY: TryItemVisibility = {
 
 const markdownDocumentsQuery = buildDocumentTypeQuery(['doc-markdown']);
 
-const SIDEBAR_LINKS = [
+const SIDEBAR_LINKS: SidebarItem[] = [
   {
     id: 'inbox',
     label: 'Inbox',
@@ -234,7 +234,7 @@ const SIDEBAR_LINKS = [
     hotkey: 'c',
     hotkeyToken: TOKENS.sidebar.goTo.channels,
   },
-] satisfies SidebarItem[];
+];
 
 export type SidebarState = 'hidden' | 'expanded' | 'slim';
 
@@ -1373,9 +1373,9 @@ export const AppSidebar = (props: AppSidebarProps) => {
       .map((id) => findLink(id))
       .filter((link): link is SidebarItem => link !== undefined)
       .map((link) => ({
+        id: link.id as SidebarSectionLinkId,
         label: link.label,
         checked: sectionVisibility()[link.id as SidebarSectionLinkId] ?? true,
-        onToggle: () => toggleSection(link.id as SidebarSectionLinkId),
       }));
 
   const tryItems = createMemo(() => {
diff --git a/apps/web/src/components/app/sidebar-next/footer-actions.tsx b/apps/web/src/components/app/sidebar-next/footer-actions.tsx
index 60d4d4b1e45..fcfee5cd8fc 100644
--- a/apps/web/src/components/app/sidebar-next/footer-actions.tsx
+++ b/apps/web/src/components/app/sidebar-next/footer-actions.tsx
@@ -2,10 +2,6 @@ import { runCreateAction } from '@app/features/command/Launcher';
 import { globalSplitManager } from '@app/signal/splitLayout';
 import { CALENDAR_BLOCK_ID } from '@block-calendar/types';
 import { SidebarSettingsWidget } from '@components/app/app-sidebar/sidebar';
-import {
-  enableChatV3Agents,
-  isFeatureEnabled,
-} from '@core/constant/featureFlags';
 import {
   type SettingsTab,
   useSettingsState,
@@ -68,13 +64,10 @@ export const FooterActions = (props: {
             // The two creatables both bind `a` and are mutually exclusive on the
             // agents flag, so pick the one that is actually registered.
             // `shouldInsert` is what `createBlock` turns into `preferNewSplit`.
-            runCreateAction(
-              isFeatureEnabled(enableChatV3Agents) ? 'agent' : 'chat',
-              {
-                shouldInsert: true,
-                source: 'sidebar',
-              }
-            )
+            runCreateAction('agent', {
+              shouldInsert: true,
+              source: 'sidebar',
+            })
           }
         >
           <SparkleIcon />
diff --git a/apps/web/src/components/app/split-layout/componentRegistry.tsx b/apps/web/src/components/app/split-layout/componentRegistry.tsx
index 2e306819861..af4ae0f91e9 100644
--- a/apps/web/src/components/app/split-layout/componentRegistry.tsx
+++ b/apps/web/src/components/app/split-layout/componentRegistry.tsx
@@ -13,6 +13,7 @@ import { getViewPreset } from '@app/features/next-soup/sidebar/soup-filter-prese
 import { NonMemberChannelPreview } from '@app/features/next-soup/soup-view/non-member-channel-preview';
 import { SoupView } from '@app/features/next-soup/soup-view/soup-view';
 import { useRecentViewFlag } from '@app/features/next-soup/use-recent-view-flag';
+import { ReminderEditorSplit } from '@app/features/reminders/ReminderEditorSplit';
 import { SettingsPanelComponentWrapper } from '@app/features/settings/Settings';
 import { useAnalytics } from '@app/lib/analytics/analytics-context';
 import { useFeatureFlag, usePosthog } from '@app/lib/analytics/posthog';
@@ -190,7 +191,12 @@ export function resolveComponent(
       }
     }
     const fallback = REGISTRY.get('inbox');
-    if (fallback) return fallback;
+    if (fallback) {
+      return {
+        element: () => fallback.factory(params ?? {}),
+        initialMeta: fallback.initialMeta,
+      };
+    }
     throw new Error(`Component '${name}' not registered`);
   }
   return {
diff --git a/apps/web/src/components/app/split-layout/components/SplitHeader.tsx b/apps/web/src/components/app/split-layout/components/SplitHeader.tsx
index b73dd5b0020..f96456517d4 100644
--- a/apps/web/src/components/app/split-layout/components/SplitHeader.tsx
+++ b/apps/web/src/components/app/split-layout/components/SplitHeader.tsx
@@ -100,7 +100,7 @@ function SplitBackButton() {
       square
       size="sm"
       class="p-1 rounded-lg touch:active:bg-transparent"
-      label={() => t('Go Back')}
+      label={t('Go Back')}
       hotkey={TOKENS.split.go.back}
       disabled={!context.handle.canGoBack()}
       onClick={() => {
@@ -121,7 +121,7 @@ function SplitForwardButton() {
       square
       size="sm"
       class="p-1 rounded-lg touch:active:bg-transparent"
-      label={() => t('Go Forward')}
+      label={t('Go Forward')}
       hotkey={TOKENS.split.go.forward}
       disabled={!context.handle.canGoForward()}
       onClick={context.handle.goForward}
@@ -278,7 +278,7 @@ function SoupNavigationButtons() {
       <div class="flex items-center gap-0.5">
         <Button
           class="p-1 rounded-lg"
-          label={() => t('Previous item')}
+          label={t('Previous item')}
           hotkey={TOKENS.entity.step.start}
           disabled={!canNavigateUp()}
           onClick={() => navigate(-1)}
@@ -287,7 +287,7 @@ function SoupNavigationButtons() {
         </Button>
         <Button
           class="p-1 rounded-lg"
-          label={() => t('Next item')}
+          label={t('Next item')}
           hotkey={TOKENS.entity.step.end}
           disabled={!canNavigateDown()}
           onClick={() => navigate(1)}
diff --git a/apps/web/src/components/app/split-layout/layoutManager.ts b/apps/web/src/components/app/split-layout/layoutManager.ts
index 6f9d86f89f0..e42dc649c84 100644
--- a/apps/web/src/components/app/split-layout/layoutManager.ts
+++ b/apps/web/src/components/app/split-layout/layoutManager.ts
@@ -504,7 +504,7 @@ export type SplitHandle<TMeta extends ComponentMeta = ComponentMeta> = {
    * without a new entry). A no-op unless the split currently shows a block of
    * `type`.
    */
-  adoptContentId: (options: { type: BlockName; nextId: string }) => void;
+  adoptContentId: (options: { type: SplitContentType; nextId: string }) => void;
   removeFromHistory: (predicate: (content: SplitContent) => boolean) => void;
   toggleSpotlight: (force?: boolean) => void;
   setDisplayName: (name: string) => void;
@@ -1030,7 +1030,8 @@ export function createSplitLayout(
    * cause is `replace`, so the URL sync swaps the path in place instead of
    * adding a back step to a placeholder the user can never return to.
    */
-  function adoptContentId(id: SplitId, type: BlockName, nextId: string) {
+  function adoptContentId(id: SplitId, type: SplitContentType, nextId: string) {
+    if (type === 'component') return;
     const i = splitIndexById(id);
     if (i < 0) return;
 
diff --git a/apps/web/src/features/auth/EmailForm.tsx b/apps/web/src/features/auth/EmailForm.tsx
index be583f60188..8833a3dfdd3 100644
--- a/apps/web/src/features/auth/EmailForm.tsx
+++ b/apps/web/src/features/auth/EmailForm.tsx
@@ -1,6 +1,6 @@
 import { SERVER_HOSTS } from '@core/constant/servers';
 import { platformFetch } from '@core/util/platformFetch';
-import { authServiceClient } from '@service-auth/client';
+import { passwordLogin } from '@queries/auth/login';
 import { action, useSubmission } from '@solidjs/router';
 import { Stage } from './Shared';
 
@@ -13,6 +13,14 @@ const REDIRECT_URI = `${protocol}://${window.location.host}/app`;
 async function isPasswordLogin(email?: string | null) {
   if (!email) return false;
 
+  // FORK-CUSTOM: AUTH-SELFHOST-001 - Allow self-host admin email to trigger password login flow
+  const adminEmail = (
+    window as unknown as { __MACRO_ENV__?: { ADMIN_EMAIL?: string } }
+  ).__MACRO_ENV__?.ADMIN_EMAIL;
+  if (adminEmail && email.toLowerCase() === adminEmail.toLowerCase()) {
+    return true;
+  }
+
   const encodedEmail = new TextEncoder().encode(email.toLowerCase());
   const hashedBuffer = await crypto.subtle.digest('SHA-256', encodedEmail);
   const hashedEmail = Array.from(new Uint8Array(hashedBuffer))
@@ -34,7 +42,7 @@ export const sendEmailCode = action(async (formData: FormData) => {
     const password = formData.get('password');
     if (!password || typeof password !== 'string') return 'isPasswordLogin';
 
-    const maybeTokens = await authServiceClient.passwordLogin({
+    const maybeTokens = await passwordLogin({
       password,
       email,
     });
diff --git a/apps/web/src/features/auth/Login.tsx b/apps/web/src/features/auth/Login.tsx
index 650f8fbe8aa..c5b5854c244 100644
--- a/apps/web/src/features/auth/Login.tsx
+++ b/apps/web/src/features/auth/Login.tsx
@@ -16,11 +16,11 @@ import LogoIcon from '@icon/macro-logo.svg';
 import ArrowLeft from '@phosphor/arrow-left.svg';
 import ArrowRight from '@phosphor/arrow-right.svg';
 import { useUserInfo } from '@queries/auth';
+import { passwordlessCallback, sessionLogin } from '@queries/auth/login';
 import {
   invalidateAllAfterLogin,
   useUserInfoQuery,
 } from '@queries/auth/user-info';
-import { authServiceClient } from '@service-auth/client';
 import {
   action,
   useAction,
@@ -132,7 +132,7 @@ function LoginPicker(props: {
 
       <Show when={showApple}>
         <Button
-          variant="base"
+          variant="outline"
           class="bg-surface"
           onClick={() => startSsoLogin('Apple')}
         >
@@ -141,7 +141,7 @@ function LoginPicker(props: {
         </Button>
       </Show>
 
-      <Button variant="base" class="bg-surface" onClick={continueWithEmail}>
+      <Button variant="outline" class="bg-surface" onClick={continueWithEmail}>
         Continue with email
       </Button>
     </div>
@@ -229,12 +229,12 @@ function EmailFormNew(props: {
   });
 
   createEffect(() => {
-    if (sentEmailCode(submission.result)) {
-      props.setStage(Stage.Verify);
+    if (submission.result === 'LoggedIn') {
+      props.setStage(Stage.Done);
     } else if (submission.result === 'isPasswordLogin') {
       setIsPasswordLogin(true);
-    } else if (submission.result === 'LoggedIn') {
-      props.setStage(Stage.Done);
+    } else if (sentEmailCode(submission.result)) {
+      props.setStage(Stage.Verify);
     }
   });
 
@@ -267,7 +267,7 @@ function EmailFormNew(props: {
         Continue
         <ArrowRight class="size-4" />
       </Button>
-      <Button variant="base" class="bg-surface" onClick={props.onBack}>
+      <Button variant="outline" class="bg-surface" onClick={props.onBack}>
         <ArrowLeft class="size-4" />
         Back to sign in
       </Button>
@@ -281,7 +281,7 @@ const verifyCode = action(async (formData: FormData) => {
   const email = formData.get('email');
   if (typeof email !== 'string') throw new Error('Invalid email');
 
-  const result = await authServiceClient.passwordlessCallback({ code, email });
+  const result = await passwordlessCallback({ code, email });
   if (result.isErr()) {
     if (result.error.some((err) => err.code === 'UNAUTHORIZED')) {
       throw new Error('Invalid code.');
@@ -442,7 +442,7 @@ function VerifyFormNew(props: {
         Verify
         <ArrowRight class="size-4" />
       </Button>
-      <Button variant="base" class="bg-surface" onClick={props.onBack}>
+      <Button variant="outline" class="bg-surface" onClick={props.onBack}>
         <ArrowLeft class="size-4" />
         Change email
       </Button>
@@ -492,9 +492,10 @@ export function Login(props: { signupMode?: boolean }) {
       ? rawToken[rawToken.length - 1]
       : rawToken;
     if (session_code && typeof session_code === 'string') {
-      unsetTokenPromise();
-      authServiceClient.sessionLogin({ session_code }).then(async (res) => {
+      void (async () => {
+        const res = await sessionLogin({ session_code });
         if (res.isOk()) {
+          unsetTokenPromise();
           await invalidateAllAfterLogin();
           await initEmailLink().match(
             () => {},
@@ -505,7 +506,7 @@ export function Login(props: { signupMode?: boolean }) {
             }
           );
         }
-      });
+      })();
     }
   });
 
diff --git a/apps/web/src/features/block-automation/component/Automation.tsx b/apps/web/src/features/block-automation/component/Automation.tsx
index 22232571bd4..f953299cb9f 100644
--- a/apps/web/src/features/block-automation/component/Automation.tsx
+++ b/apps/web/src/features/block-automation/component/Automation.tsx
@@ -12,6 +12,7 @@ import { useBlockId } from '@core/block';
 import { EntityIcon } from '@core/component/EntityIcon';
 import { toast } from '@core/component/Toast/Toast';
 import { blockNameToDefaultFile } from '@core/constant/allBlocks';
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { whenSettled } from '@core/util/whenSettled';
 import { formatDateAndTime } from '@entity';
 import CopyIcon from '@phosphor/copy.svg';
@@ -125,6 +126,15 @@ function HistoryList(props: { records: HistoryRecord[]; isPending: boolean }) {
 }
 
 export function Automation() {
+  const capabilities = getAppCapabilities();
+  if (!capabilities.scheduledActions) {
+    return (
+      <div class="flex size-full items-center justify-center px-4 text-center text-xs text-ink-muted">
+        Scheduled actions are unavailable in this profile.
+      </div>
+    );
+  }
+
   const scheduleId = useBlockId();
   const panel = useSplitPanelOrThrow();
   const { replaceOrInsertSplit } = useSplitLayout();
diff --git a/apps/web/src/features/block-email/component/MessageCard.tsx b/apps/web/src/features/block-email/component/MessageCard.tsx
index ca823ebf788..9384c2dd016 100644
--- a/apps/web/src/features/block-email/component/MessageCard.tsx
+++ b/apps/web/src/features/block-email/component/MessageCard.tsx
@@ -61,7 +61,7 @@ export function MessageCard(props: MessageCardProps) {
       <div class="@container/message macro-message-width macro-message-padding w-full">
         <div
           class={cn(
-            'relative p-4 rounded-lg bg-message border border-edge-muted outline-none',
+            'relative p-4 rounded-lg overflow-hidden bg-message border border-edge-muted outline-none',
             props.isSelected
               ? 'z-1 light-mode:shadow-lg light-mode:shadow-drop-shadow dark-mode:ring-1 dark-mode:ring-accent/40'
               : props.allowHover && 'hover:overlay-hover'
diff --git a/apps/web/src/features/block-email/component/SentMessageIndicator.tsx b/apps/web/src/features/block-email/component/SentMessageIndicator.tsx
index 1e306ed9044..aaf02856857 100644
--- a/apps/web/src/features/block-email/component/SentMessageIndicator.tsx
+++ b/apps/web/src/features/block-email/component/SentMessageIndicator.tsx
@@ -25,7 +25,7 @@ export function SentMessageIndicator(
     <Show when={props.isSent}>
       <div
         class={cn(
-          'absolute -inset-y-px -left-px w-1 rounded-l-lg transition-colors duration-700 ease-[cubic-bezier(0.16,1,0.3,1)] motion-reduce:transition-none bg-accent/70'
+          'absolute inset-y-0 left-0 w-0.5 transition-colors duration-700 ease-[cubic-bezier(0.16,1,0.3,1)] motion-reduce:transition-none bg-accent/70'
         )}
         aria-hidden="true"
       />
diff --git a/apps/web/src/features/command/Launcher.tsx b/apps/web/src/features/command/Launcher.tsx
index d42b1d4a204..be99e331405 100644
--- a/apps/web/src/features/command/Launcher.tsx
+++ b/apps/web/src/features/command/Launcher.tsx
@@ -267,6 +267,8 @@ export function runCreateAction(
   const source = options.source ?? 'create_menu';
 
   switch (blockName) {
+    case 'agent':
+      return runCreateAction('chat', options);
     case 'md': {
       const span = startDocumentSpan('doc.create');
       span.setAttr('doc.type', 'md');
@@ -670,7 +672,10 @@ export function useCreateMenuBlocks(
  */
 export function useCreatableEnabled(): (name: CreatableName) => boolean {
   const blocks = useCreateMenuBlocks();
-  return (name) => blocks().some((block) => block.blockName === name);
+  return (name) =>
+    blocks().some((block) =>
+      name === 'agent' ? block.blockName === 'chat' : block.blockName === name
+    );
 }
 
 export const [createMenuOpen, setCreateMenuOpen] = createControlledOpenSignal(
diff --git a/apps/web/src/features/command/types.ts b/apps/web/src/features/command/types.ts
index 1c4928ce10e..319d5df0687 100644
--- a/apps/web/src/features/command/types.ts
+++ b/apps/web/src/features/command/types.ts
@@ -12,7 +12,7 @@ import type { Component } from 'solid-js';
  * than in `BlockAliasRegistry`, where it would leak into `fileTypeToBlockName`,
  * split content types and `NonDocumentBlockTypes`.
  */
-export type CreatableName = BlockName | BlockAlias | 'reminder';
+export type CreatableName = BlockName | BlockAlias | 'reminder' | 'agent';
 
 export type CreatableBlock = Omit<HotkeyRegistrationOptions, 'scopeId'> & {
   label: string;
diff --git a/apps/web/src/features/home/home.tsx b/apps/web/src/features/home/home.tsx
index 32ce3315cf1..5d02b8c2c3e 100644
--- a/apps/web/src/features/home/home.tsx
+++ b/apps/web/src/features/home/home.tsx
@@ -16,6 +16,7 @@ import { deriveChatName } from '@core/component/AI/util/deriveName';
 import {
   enableHomeRecommendations,
   enableHomeView,
+  getAppCapabilities,
 } from '@core/constant/featureFlags';
 import { PaywallKey, usePaywallState } from '@core/constant/PaywallState';
 import { useUserContext } from '@core/context/user';
@@ -24,8 +25,8 @@ import { TOKENS } from '@core/hotkey/tokens';
 import { isPaymentError } from '@core/util/handlePaymentError';
 import { createRenameDssEntityMutation } from '@entity';
 import { t } from '@macro/i18n';
+import { createChat, sendStreamChatMessage } from '@queries/chat';
 import { invalidateAllSoup } from '@queries/soup/normalized-cache';
-import { cognitionApiServiceClient } from '@service-cognition/client';
 import { Navigate } from '@solidjs/router';
 import { $getRoot } from 'lexical';
 import { createEffect } from 'solid-js';
@@ -90,6 +91,7 @@ export function Home() {
 function HomeContent() {
   const user = useUserContext();
   const preferences = createHomePreferences();
+  const capabilities = getAppCapabilities();
 
   const firstName = () => {
     const name = user.author();
@@ -153,7 +155,13 @@ function HomeContent() {
 
       <FloatRegionOrInline region="accessory">
         <div class="mx-auto w-full max-w-3xl shrink-0 px-4 pb-3 pointer-events-auto touch:px-(--mobile-chrome-gutter) touch:pb-0">
-          <HomeChatInput />
+          {capabilities.cognition ? (
+            <HomeChatInput />
+          ) : (
+            <div class="rounded-md border border-edge-muted bg-surface px-3 py-2 text-xs text-ink-muted">
+              Chat is unavailable in this profile.
+            </div>
+          )}
         </div>
       </FloatRegionOrInline>
     </main>
@@ -214,7 +222,7 @@ const HomeChatInput = () => {
     const backgroundSend = request.metaKey;
 
     // Create a new persistent chat
-    const response = await cognitionApiServiceClient.createChat({});
+    const response = await createChat({});
     if (response.isErr()) {
       if (isPaymentError(response)) {
         const { showPaywall } = usePaywallState();
@@ -235,7 +243,7 @@ const HomeChatInput = () => {
 
     if (backgroundSend) {
       // Send the message in the background without navigating
-      cognitionApiServiceClient.sendStreamChatMessage({
+      sendStreamChatMessage({
         content: request.content,
         model: request.model,
         chat_id: chatId,
diff --git a/apps/web/src/features/next-soup/soup-view/soup-view-create-button.tsx b/apps/web/src/features/next-soup/soup-view/soup-view-create-button.tsx
index 530ac39038b..230fffe390f 100644
--- a/apps/web/src/features/next-soup/soup-view/soup-view-create-button.tsx
+++ b/apps/web/src/features/next-soup/soup-view/soup-view-create-button.tsx
@@ -63,6 +63,7 @@ const CREATE_COMPANY_OPTION: CreateOption = {
  */
 const VIEW_ONLY_BLOCK_LABELS: Partial<Record<CreatableName, string>> = {
   automation: 'Automation',
+  agent: 'Agent',
 };
 
 const VIEW_CREATE_LABELS: Partial<Record<ListView, string>> = {
@@ -81,13 +82,15 @@ function getViewCreateOptions(
 ): CreateOption[] {
   const createNames = VIEW_CREATE_BLOCKNAMES[view] ?? [];
   const options: CreateOption[] = createNames.flatMap((name) => {
-    const block = CREATABLE_BLOCKS.find((b) => b.blockName === name);
+    const block = CREATABLE_BLOCKS.find((b) =>
+      name === 'agent' ? b.blockName === 'chat' : b.blockName === name
+    );
     if (block) {
       // A flagged-off entry is not offered here either, the same as in the
       // create menus — `runCreateAction` would decline it anyway. Asked
       // reactively, so an option appears once its flag resolves.
       if (!isCreatableEnabled(block.blockName)) return [];
-      return [{ id: block.blockName, label: block.label }];
+      return [{ id: name, label: name === 'agent' ? 'Agent' : block.label }];
     }
     const viewOnlyLabel = VIEW_ONLY_BLOCK_LABELS[name];
     if (viewOnlyLabel) return [{ id: name, label: viewOnlyLabel }];
diff --git a/apps/web/src/features/next-soup/soup-view/soup-view-tabs.tsx b/apps/web/src/features/next-soup/soup-view/soup-view-tabs.tsx
index ca81b3e0cbf..11e96c34fa8 100644
--- a/apps/web/src/features/next-soup/soup-view/soup-view-tabs.tsx
+++ b/apps/web/src/features/next-soup/soup-view/soup-view-tabs.tsx
@@ -287,7 +287,7 @@ export const CollapsedSoupViewTabs = () => {
       when={listView() !== 'companies'}
       fallback={
         <TabsInsetDropdown
-          list={COMPANY_MODE_TABS}
+          list={getCompanyModeTabs()}
           value={viewMode()}
           defaultValue="board"
           onChange={(value) => setViewMode(value as SoupViewMode)}
diff --git a/apps/web/src/features/property/tags/AwaitingReplyTag.tsx b/apps/web/src/features/property/tags/AwaitingReplyTag.tsx
index 4d5f2b7a796..130b48ea3b5 100644
--- a/apps/web/src/features/property/tags/AwaitingReplyTag.tsx
+++ b/apps/web/src/features/property/tags/AwaitingReplyTag.tsx
@@ -1,4 +1,4 @@
-import type { EmailEntity } from '@features/entity/types/entity';
+import type { EmailEntity } from '@entity';
 import { useTagsQuery } from '@queries/properties/tags';
 import { cn } from '@ui';
 import { createMemo, type JSX, Show } from 'solid-js';
@@ -122,7 +122,7 @@ export function AwaitingReplyTag(props: AwaitingReplyTagProps): JSX.Element {
           }
         }}
       >
-        <TagDot color={tagOption()?.color} class="size-2" />
+        <TagDot color={tagOption()?.color ?? undefined} class="size-2" />
         <span class="min-w-0 truncate">{tagOption()?.label}</span>
       </span>
     </Show>
diff --git a/apps/web/src/lib/constants/list-views.ts b/apps/web/src/lib/constants/list-views.ts
index 6745bd3d28a..520c33a2822 100644
--- a/apps/web/src/lib/constants/list-views.ts
+++ b/apps/web/src/lib/constants/list-views.ts
@@ -13,7 +13,9 @@ export const LIST_VIEWS = [
   'agents',
   'mail',
   'documents',
+  'tasks',
   'channels',
+  'calls',
   'companies',
   'folders',
   'reminders',
@@ -28,7 +30,9 @@ export const LIST_VIEW_PATHS = {
   agents: '/agents',
   mail: '/mail',
   documents: '/documents',
+  tasks: '/tasks',
   channels: '/channels',
+  calls: '/calls',
   companies: '/companies',
   folders: '/folders',
   reminders: '/reminders',
@@ -41,7 +45,9 @@ export const LIST_VIEW_ID = {
   agents: 'agents',
   mail: 'mail',
   documents: 'documents',
+  tasks: 'tasks',
   channels: 'channels',
+  calls: 'calls',
   companies: 'companies',
   folders: 'folders',
   reminders: 'reminders',
diff --git a/apps/web/src/lib/core/block.ts b/apps/web/src/lib/core/block.ts
index a80005ad40d..782c95a20f3 100644
--- a/apps/web/src/lib/core/block.ts
+++ b/apps/web/src/lib/core/block.ts
@@ -58,6 +58,7 @@ export const BlockRegistry = [
   'image',
   'canvas',
   'channel',
+  'call',
   'project',
   'unknown',
   'video',
@@ -86,7 +87,13 @@ export type BlockName = (typeof BlockRegistry)[BlockNameKeys];
  * List of strongly-typed, valid aliases that can be used as pseudo-differentiated
  * block types.
  */
-export const BlockAliasRegistry = ['csv', 'task', 'snippet', 'skill'] as const;
+export const BlockAliasRegistry = [
+  'csv',
+  'task',
+  'snippet',
+  'skill',
+  'agent',
+] as const;
 
 type BlockAliasKeys = keyof typeof BlockAliasRegistry & number;
 
@@ -103,6 +110,7 @@ export const NonDocumentBlockTypes = [
   'calendar',
   'chat',
   'channel',
+  'call',
   'project',
   'email',
   'contact',
@@ -193,6 +201,7 @@ export const ValidNestingCombinations: BlockCombinationRules = {
   automation: new Set([]),
   csv: new Set([]),
   pr: new Set([]),
+  agent: new Set([]),
 };
 
 export const LoadErrors = {
diff --git a/apps/web/src/lib/core/collab-surface/token.ts b/apps/web/src/lib/core/collab-surface/token.ts
index 3f593e0bcf1..398c1387335 100644
--- a/apps/web/src/lib/core/collab-surface/token.ts
+++ b/apps/web/src/lib/core/collab-surface/token.ts
@@ -1,5 +1,6 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { isTokenExpired } from '@core/signal/token';
-import { storageServiceClient } from '@service-storage/client';
+import { createCollabSurfaceToken } from '@queries/storage/collab-surface-token';
 
 type Token = string;
 
@@ -18,14 +19,17 @@ const surfaceTokenCache = new Map<string, Token>();
 export async function getCollabSurfaceToken(
   surfaceId: string
 ): Promise<string | undefined> {
+  const capabilities = getAppCapabilities();
+  if (!capabilities.docsCollab) {
+    return undefined;
+  }
+
   const cached = surfaceTokenCache.get(surfaceId);
   if (cached && !isTokenExpired(cached)) {
     return cached;
   }
 
-  const response = await storageServiceClient.collabSurfaces.createToken({
-    id: surfaceId,
-  });
+  const response = await createCollabSurfaceToken(surfaceId);
   if (response.isErr()) {
     console.error('failed to mint collab surface token', response.error);
     return undefined;
diff --git a/apps/web/src/lib/core/constant/featureFlags.ts b/apps/web/src/lib/core/constant/featureFlags.ts
index 50241133577..5bdfcded0fe 100644
--- a/apps/web/src/lib/core/constant/featureFlags.ts
+++ b/apps/web/src/lib/core/constant/featureFlags.ts
@@ -90,7 +90,6 @@ export function defineFlag(config: RemoteFlagConfig | EnvFlagConfig): Flag {
     enabled: envOverride(config.env) ?? config.default ?? false,
   };
 }
-
 /**
  * Imperative snapshot. Env/`default` override wins. Otherwise PostHog,
  * or `false` if flags have not loaded or the key is unknown.
@@ -650,7 +649,7 @@ export const enableActivityFeed = defineFlag({
 export const enableChatV3Agents = defineFlag({
   key: 'enable-chat-v3-agents',
   env: 'ENABLE_CHAT_V3_AGENTS',
-  default: onInDev,
+  default: getAppCapabilities().agents ? onInDev : false,
 });
 
 // The `@cursor` mention entry: agent sessions served by Cursor cloud agents
@@ -660,7 +659,7 @@ export const enableChatV3Agents = defineFlag({
 export const enableCursorAgents = defineFlag({
   key: 'enable-cursor-agents',
   env: 'ENABLE_CURSOR_AGENTS',
-  default: onInDev,
+  default: getAppCapabilities().agents ? onInDev : false,
 });
 
 // The Recent view: the touched-by-me feed (everything the viewer mutated,
@@ -689,3 +688,70 @@ export const enableDirectAttachmentDownload = defineFlag({
   env: 'ENABLE_DIRECT_ATTACHMENT_DOWNLOAD',
   default: false,
 });
+
+// Self-host capability gating: In focused profiles (e.g. Email self-host),
+// backend services like document_cognition_service and scheduled_action_service
+// are not running by default. The web frontend gates feature queries to avoid
+// firing requests to non-existent backend containers (preventing 502s).
+export interface AppCapabilities {
+  cognition: boolean;
+  scheduledActions: boolean;
+  agents: boolean;
+  docsCollab: boolean;
+}
+
+export function isSelfHost(): boolean {
+  if (typeof window === 'undefined') return false;
+  const isLocalBackend =
+    import.meta.env.VITE_LOCAL_BACKEND_ORIGIN === 'same-origin' ||
+    Boolean(import.meta.env.VITE_LOCAL_BACKEND_ORIGIN);
+  const hasMacroEnv = Boolean(
+    (window as unknown as { __MACRO_ENV__?: unknown }).__MACRO_ENV__
+  );
+  const hostname = window.location.hostname;
+  const isCustomHost =
+    hostname !== 'app.macro.com' &&
+    hostname !== 'dev.macro.com' &&
+    !hostname.endsWith('.macro.com');
+  return isLocalBackend || hasMacroEnv || isCustomHost;
+}
+
+function getRuntimeFeatures(): Partial<AppCapabilities> | undefined {
+  if (typeof window === 'undefined') return undefined;
+  return (
+    window as unknown as {
+      __MACRO_ENV__?: { FEATURES?: Partial<AppCapabilities> };
+    }
+  ).__MACRO_ENV__?.FEATURES;
+}
+
+function resolveCapability(
+  env: string,
+  runtimeValue: boolean | undefined,
+  selfHost: boolean
+): boolean {
+  return getFeatureFlagOverride(env) ?? runtimeValue ?? !selfHost;
+}
+
+export function getAppCapabilities(): AppCapabilities {
+  const features = getRuntimeFeatures();
+  const selfHost = isSelfHost();
+  return {
+    cognition: resolveCapability(
+      'ENABLE_COGNITION',
+      features?.cognition,
+      selfHost
+    ),
+    scheduledActions: resolveCapability(
+      'ENABLE_SCHEDULED_ACTIONS',
+      features?.scheduledActions,
+      selfHost
+    ),
+    agents: resolveCapability('ENABLE_AGENTS', features?.agents, selfHost),
+    docsCollab: resolveCapability(
+      'ENABLE_DOCS_COLLAB',
+      features?.docsCollab,
+      selfHost
+    ),
+  };
+}
diff --git a/apps/web/src/lib/core/util/safeFetch.ts b/apps/web/src/lib/core/util/safeFetch.ts
index cc141d38320..a8869def311 100644
--- a/apps/web/src/lib/core/util/safeFetch.ts
+++ b/apps/web/src/lib/core/util/safeFetch.ts
@@ -235,10 +235,103 @@ export type TextResponse = { contentType: 'text/plain'; body: string };
  *   console.log('User data:', user);
  * }
  */
+type SuperAdminMacroEnv = { ADMIN_EMAIL?: string };
+type SuperAdminFallbackHandler = {
+  matches: (path: string) => boolean;
+  response: (env: SuperAdminMacroEnv) => unknown;
+};
+
+const includesAny = (path: string, fragments: readonly string[]) =>
+  fragments.some((fragment) => path.includes(fragment));
+
+const SUPER_ADMIN_FALLBACKS: readonly SuperAdminFallbackHandler[] = [
+  {
+    matches: (path) => path.includes('/email/links'),
+    response: () => ({ links: [] }),
+  },
+  {
+    matches: (path) => includesAny(path, ['/invites', '/user/invites']),
+    response: () => ({ invites: [] }),
+  },
+  {
+    matches: (path) =>
+      includesAny(path, ['/profile_pictures', '/profile-pictures']),
+    response: () => ({ pictures: [] }),
+  },
+  {
+    matches: (path) => path.includes('/team'),
+    response: (env) => ({
+      team: {
+        id: '00000000-0000-0000-0000-000000000001',
+        name: 'Macro Workspace',
+        role: 'owner',
+      },
+      members: [
+        {
+          id: '00000000-0000-0000-0000-000000000001',
+          email: env.ADMIN_EMAIL,
+          role: 'owner',
+        },
+      ],
+      invites: [],
+    }),
+  },
+  {
+    matches: (path) => path.includes('/contacts'),
+    response: () => ({ contacts: [], total: 0 }),
+  },
+  { matches: (path) => path.includes('/properties'), response: () => [] },
+  {
+    matches: (path) => path.includes('/items/soup/ast/grouped'),
+    response: () => ({ items: [], groups: [], mode: 'initial' }),
+  },
+  {
+    matches: (path) => path.includes('/items/soup'),
+    response: () => ({ items: [], next_cursor: null }),
+  },
+  {
+    matches: (path) => includesAny(path, ['/channels/activity', '/activity']),
+    response: () => [],
+  },
+  {
+    matches: (path) => path.includes('/channels'),
+    response: () => ({ items: [], channels: [], next_cursor: null }),
+  },
+  {
+    matches: (path) => path.includes('/user_notifications'),
+    response: () => ({ notifications: [], total: 0 }),
+  },
+  { matches: (path) => path.includes('/mcp/servers'), response: () => [] },
+  {
+    matches: (path) => path.includes('/calendar-events'),
+    response: () => ({ occurrences: [], next_cursor: null }),
+  },
+  {
+    matches: (path) => path.includes('/favorites'),
+    response: () => ({ favorites: [] }),
+  },
+  {
+    matches: (path) => path.includes('/history'),
+    response: () => ({ data: [] }),
+  },
+  {
+    matches: (path) => path.includes('/jwt/refresh'),
+    response: () => ({
+      access_token: 'local-super-admin-token',
+      refresh_token: 'local-super-admin-refresh',
+    }),
+  },
+  {
+    matches: (path) => includesAny(path, ['/bots', '/agents']),
+    response: () => [],
+  },
+];
+
 function getSuperAdminFallback(input: RequestInfo): unknown | undefined {
   if (typeof window === 'undefined') return undefined;
   const isCustomHost = window.location.hostname !== 'app.macro.com';
-  const macroEnv = (window as any).__MACRO_ENV__;
+  const macroEnv = (window as unknown as { __MACRO_ENV__?: SuperAdminMacroEnv })
+    .__MACRO_ENV__;
   if (!isCustomHost || !macroEnv?.ADMIN_EMAIL) {
     return undefined;
   }
@@ -257,80 +350,11 @@ function getSuperAdminFallback(input: RequestInfo): unknown | undefined {
     return undefined;
   }
 
-  const path = url.pathname;
-  if (path.includes('/email/links')) {
-    return { links: [] };
-  }
-  if (path.includes('/invites') || path.includes('/user/invites')) {
-    return { invites: [] };
-  }
-  if (
-    path.includes('/profile_pictures') ||
-    path.includes('/profile-pictures')
-  ) {
-    return { pictures: [] };
-  }
-  if (path.includes('/team')) {
-    return {
-      team: {
-        id: '00000000-0000-0000-0000-000000000001',
-        name: 'Macro Workspace',
-        role: 'owner',
-      },
-      members: [
-        {
-          id: '00000000-0000-0000-0000-000000000001',
-          email: macroEnv.ADMIN_EMAIL,
-          role: 'owner',
-        },
-      ],
-      invites: [],
-    };
-  }
-  if (path.includes('/contacts')) {
-    return { contacts: [], total: 0 };
-  }
-  if (path.includes('/properties')) {
-    return [];
-  }
-  if (path.includes('/items/soup/ast/grouped')) {
-    return { items: [], groups: [], mode: 'initial' };
-  }
-  if (path.includes('/items/soup')) {
-    return { items: [], next_cursor: null };
-  }
-  if (path.includes('/channels/activity') || path.includes('/activity')) {
-    return [];
-  }
-  if (path.includes('/channels')) {
-    return { items: [], channels: [], next_cursor: null };
-  }
-  if (path.includes('/user_notifications')) {
-    return { notifications: [], total: 0 };
-  }
-  if (path.includes('/mcp/servers')) {
-    return [];
-  }
-  if (path.includes('/calendar-events')) {
-    return { occurrences: [], next_cursor: null };
-  }
-  if (path.includes('/favorites')) {
-    return { favorites: [] };
-  }
-  if (path.includes('/history')) {
-    return { data: [] };
-  }
-  if (path.includes('/jwt/refresh')) {
-    return {
-      access_token: 'local-super-admin-token',
-      refresh_token: 'local-super-admin-refresh',
-    };
-  }
-  if (path.includes('/bots') || path.includes('/agents')) {
-    return [];
-  }
-
-  return {};
+  return (
+    SUPER_ADMIN_FALLBACKS.find((handler) =>
+      handler.matches(url.pathname)
+    )?.response(macroEnv) ?? {}
+  );
 }
 
 export async function safeFetch<
@@ -419,7 +443,7 @@ export async function safeFetch<
 
         if (contentType.includes('text/plain')) {
           const text = await response.text();
-          return ok({ contentType, body: text } as T);
+          return ok({ contentType, body: text } as unknown as T);
         }
 
         if (contentType.includes('application/octet-stream')) {
diff --git a/apps/web/src/lib/queries/agent-schedule/schedules.ts b/apps/web/src/lib/queries/agent-schedule/schedules.ts
index 72f367fb639..45fe5d295e8 100644
--- a/apps/web/src/lib/queries/agent-schedule/schedules.ts
+++ b/apps/web/src/lib/queries/agent-schedule/schedules.ts
@@ -1,3 +1,4 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { throwOnErr } from '@core/util/result';
 import { queryClient } from '@queries/client';
 import { type MutationCallbacks, withCallbacks } from '@queries/utils';
@@ -42,13 +43,20 @@ function removeSchedule(scheduleId: string) {
   );
 }
 
+const NO_SCHEDULES: ScheduledAction[] = [];
+
 export function useSchedulesQuery(enabled: Accessor<boolean>) {
+  const capabilities = getAppCapabilities();
   return useQuery(() => ({
     queryKey: scheduledActionKeys.list.queryKey,
-    enabled: enabled(),
-    queryFn: async () =>
-      throwOnErr(async () => await scheduledActionClient.listSchedules()),
-    placeholderData: (prev: ScheduledAction[] | undefined) => prev,
+    enabled: capabilities.scheduledActions && enabled(),
+    queryFn: async () => {
+      if (!capabilities.scheduledActions) return NO_SCHEDULES;
+      return throwOnErr(
+        async () => await scheduledActionClient.listSchedules()
+      );
+    },
+    placeholderData: NO_SCHEDULES,
     reconcile: 'id',
     ...QUERY_REFETCH_BEHAVIOR,
   }));
@@ -58,6 +66,7 @@ export function useScheduleHistoryQuery(
   scheduleId: Accessor<string | null | undefined>,
   enabled: Accessor<boolean>
 ) {
+  const capabilities = getAppCapabilities();
   return useQuery(() => {
     const currentScheduleId = scheduleId();
 
@@ -65,14 +74,19 @@ export function useScheduleHistoryQuery(
       queryKey: scheduledActionKeys.history({
         scheduleId: currentScheduleId ?? '__none__',
       }).queryKey,
-      enabled: enabled() && Boolean(currentScheduleId),
-      queryFn: async () =>
-        throwOnErr(
+      enabled:
+        capabilities.scheduledActions &&
+        enabled() &&
+        Boolean(currentScheduleId),
+      queryFn: async () => {
+        if (!capabilities.scheduledActions || !currentScheduleId) return [];
+        return throwOnErr(
           async () =>
             await scheduledActionClient.listHistory({
               scheduleId: currentScheduleId!,
             })
-        ),
+        );
+      },
       placeholderData: (prev: ActionExecutionRecord[] | undefined) => prev,
       ...QUERY_REFETCH_BEHAVIOR,
     };
diff --git a/apps/web/src/lib/queries/auth/login.ts b/apps/web/src/lib/queries/auth/login.ts
new file mode 100644
index 00000000000..2ce1b8b563c
--- /dev/null
+++ b/apps/web/src/lib/queries/auth/login.ts
@@ -0,0 +1,13 @@
+import { authServiceClient } from '@service-auth/client';
+
+export function passwordLogin(args: { email: string; password: string }) {
+  return authServiceClient.passwordLogin(args);
+}
+
+export function passwordlessCallback(args: { email: string; code: string }) {
+  return authServiceClient.passwordlessCallback(args);
+}
+
+export function sessionLogin(args: { session_code: string }) {
+  return authServiceClient.sessionLogin(args);
+}
diff --git a/apps/web/src/lib/queries/chat.ts b/apps/web/src/lib/queries/chat.ts
index e045a50f3b3..a5614207185 100644
--- a/apps/web/src/lib/queries/chat.ts
+++ b/apps/web/src/lib/queries/chat.ts
@@ -32,6 +32,16 @@ export function useChatQuery(chatId: () => string | undefined) {
   });
 }
 
+export function createChat(args: Record<string, never>) {
+  return cognitionApiServiceClient.createChat(args);
+}
+
+export function sendStreamChatMessage(
+  args: Parameters<typeof cognitionApiServiceClient.sendStreamChatMessage>[0]
+) {
+  return cognitionApiServiceClient.sendStreamChatMessage(args);
+}
+
 export function useChatRenameWebsocketSync() {
   createConnectionWebsocketEffect((message) => {
     if (message.type !== CHAT_RENAMED_MESSAGE_TYPE) return;
diff --git a/apps/web/src/lib/queries/mcp-servers.ts b/apps/web/src/lib/queries/mcp-servers.ts
index 1902c85659b..0c7dffca4ee 100644
--- a/apps/web/src/lib/queries/mcp-servers.ts
+++ b/apps/web/src/lib/queries/mcp-servers.ts
@@ -1,3 +1,4 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { throwOnErr } from '@core/util/result';
 import { queryClient } from '@queries/client';
 import { cognitionApiServiceClient } from '@service-cognition/client';
@@ -34,14 +35,22 @@ export function useMcpServersQuery(options?: {
    */
   neverSuspend?: boolean;
 }) {
+  const capabilities = getAppCapabilities();
   return useQuery(() => ({
     queryKey: KEYS.list,
-    queryFn: async () =>
-      throwOnErr(async () => await cognitionApiServiceClient.listMcpServers()),
-    refetchOnMount: 'always' as const,
-    refetchOnWindowFocus: 'always' as const,
-    refetchInterval: options?.refetchInterval,
-    placeholderData: options?.neverSuspend ? NO_SERVERS : undefined,
+    enabled: capabilities.cognition,
+    queryFn: async () => {
+      if (!capabilities.cognition) return NO_SERVERS;
+      return throwOnErr(
+        async () => await cognitionApiServiceClient.listMcpServers()
+      );
+    },
+    refetchOnMount: capabilities.cognition ? ('always' as const) : false,
+    refetchOnWindowFocus: capabilities.cognition ? ('always' as const) : false,
+    refetchInterval: capabilities.cognition
+      ? options?.refetchInterval
+      : undefined,
+    placeholderData: NO_SERVERS,
   }));
 }
 
diff --git a/apps/web/src/lib/queries/persistence.ts b/apps/web/src/lib/queries/persistence.ts
index 114439bdefd..cfb3ee2e20c 100644
--- a/apps/web/src/lib/queries/persistence.ts
+++ b/apps/web/src/lib/queries/persistence.ts
@@ -2,11 +2,7 @@ import {
   type ParsedDuration,
   parsedDurationToMilliseconds,
 } from '@core/util/dateSearch/dateParser';
-import type {
-  Query,
-  QueryCacheNotifyEvent,
-  QueryKey,
-} from '@tanstack/query-core';
+import type { QueryKey } from '@tanstack/query-core';
 import type {
   PerQueryPersistence,
   PersistedQueryEntry,
@@ -33,7 +29,7 @@ export type PersistScope = Readonly<{
 
 type QueryClientLike = {
   getQueryCache: () => {
-    subscribe: (listener: (event: QueryCacheNotifyEvent) => void) => () => void;
+    subscribe: (listener: (event: unknown) => void) => () => void;
   };
   getQueryState: (
     queryKey: QueryKey
@@ -45,6 +41,21 @@ type QueryClientLike = {
   ) => void;
 };
 
+type QueryLike = {
+  queryHash: string;
+  queryKey: QueryKey;
+  state: {
+    status: string;
+    data: unknown;
+    dataUpdatedAt: number;
+  };
+};
+
+type QueryCacheEventLike = {
+  type: 'added' | 'updated' | 'removed' | string;
+  query: QueryLike;
+};
+
 /**
  * Validates a persisted entry against the current cache-buster and optional
  * max age.
@@ -71,7 +82,7 @@ function validatePersistedEntry(
 async function handleRestore(
   queryClient: QueryClientLike,
   scope: PersistScope,
-  query: Query
+  query: QueryLike
 ): Promise<void> {
   if (scope.shouldRestore && !scope.shouldRestore(query.queryKey)) return;
 
@@ -107,7 +118,7 @@ async function handleRestore(
 /**
  * Persists a query's current data to IDB when the query updates successfully.
  */
-function handleUpdate(scope: PersistScope, query: Query): void {
+function handleUpdate(scope: PersistScope, query: QueryLike): void {
   if (query.state.status !== 'success') return;
   scope.store.set({
     queryHash: query.queryHash,
@@ -152,7 +163,8 @@ export function setupQueryPersistence(
   };
   document.addEventListener('visibilitychange', onVisibilityChange);
 
-  const cacheUnsubscribe = queryClient.getQueryCache().subscribe((event) => {
+  const cacheUnsubscribe = queryClient.getQueryCache().subscribe((rawEvent) => {
+    const event = rawEvent as QueryCacheEventLike;
     const { type } = event;
     if (type !== 'added' && type !== 'updated' && type !== 'removed') return;
 
diff --git a/apps/web/src/lib/queries/pipedream-connectors.ts b/apps/web/src/lib/queries/pipedream-connectors.ts
index 329ae4d8dee..24ca4947081 100644
--- a/apps/web/src/lib/queries/pipedream-connectors.ts
+++ b/apps/web/src/lib/queries/pipedream-connectors.ts
@@ -1,3 +1,4 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { openPipedreamConnectUI } from '@core/pipedream/connect-ui';
 import { ThrownResultError, throwOnErr } from '@core/util/result';
 import { queryClient } from '@queries/client';
@@ -35,16 +36,22 @@ export function usePipedreamConnectionsQuery(options?: {
   /** See the same option on `useMcpServersQuery`. */
   neverSuspend?: boolean;
 }) {
+  const capabilities = getAppCapabilities();
   return useQuery(() => ({
     queryKey: KEYS.list,
-    queryFn: async () =>
-      throwOnErr(
+    enabled: capabilities.cognition,
+    queryFn: async () => {
+      if (!capabilities.cognition) return NO_CONNECTIONS;
+      return throwOnErr(
         async () => await cognitionApiServiceClient.listPipedreamConnections()
-      ),
-    refetchOnMount: 'always' as const,
-    refetchOnWindowFocus: 'always' as const,
-    refetchInterval: options?.refetchInterval,
-    placeholderData: options?.neverSuspend ? NO_CONNECTIONS : undefined,
+      );
+    },
+    refetchOnMount: capabilities.cognition ? ('always' as const) : false,
+    refetchOnWindowFocus: capabilities.cognition ? ('always' as const) : false,
+    refetchInterval: capabilities.cognition
+      ? options?.refetchInterval
+      : undefined,
+    placeholderData: NO_CONNECTIONS,
   }));
 }
 
diff --git a/apps/web/src/lib/queries/soup/normalized-cache/normalizer.ts b/apps/web/src/lib/queries/soup/normalized-cache/normalizer.ts
index 34bae70c456..435d0c24a94 100644
--- a/apps/web/src/lib/queries/soup/normalized-cache/normalizer.ts
+++ b/apps/web/src/lib/queries/soup/normalized-cache/normalizer.ts
@@ -52,10 +52,13 @@ export function getSoupNormalizer(): ReturnType<typeof createQueryNormalizer> {
  * Accepts queryClient as a parameter to avoid circular imports.
  */
 export function initSoupNormalizer(qc: QueryClient): () => void {
-  _normalizer = createQueryNormalizer(qc, {
-    getNormalizationObjectKey,
-    normalize: false,
-  });
+  _normalizer = createQueryNormalizer(
+    qc as unknown as Parameters<typeof createQueryNormalizer>[0],
+    {
+      getNormalizationObjectKey,
+      normalize: false,
+    }
+  );
   _normalizer.subscribe();
   return () => _normalizer!.unsubscribe();
 }
diff --git a/apps/web/src/lib/queries/storage/collab-surface-token.ts b/apps/web/src/lib/queries/storage/collab-surface-token.ts
new file mode 100644
index 00000000000..8a76394e2a3
--- /dev/null
+++ b/apps/web/src/lib/queries/storage/collab-surface-token.ts
@@ -0,0 +1,5 @@
+import { storageServiceClient } from '@service-storage/client';
+
+export function createCollabSurfaceToken(surfaceId: string) {
+  return storageServiceClient.collabSurfaces.createToken({ id: surfaceId });
+}
diff --git a/apps/web/src/lib/service-clients/service-cognition/client.ts b/apps/web/src/lib/service-clients/service-cognition/client.ts
index 6e45de58854..f0251c3238e 100644
--- a/apps/web/src/lib/service-clients/service-cognition/client.ts
+++ b/apps/web/src/lib/service-clients/service-cognition/client.ts
@@ -1,3 +1,4 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { SERVER_HOSTS } from '@core/constant/servers';
 import { setCachedInputStore } from '@core/store/cacheChatInput';
 import { cache } from '@core/util/cache';
@@ -62,6 +63,19 @@ async function dcsFetch<T extends ObjectLike = never>(
   | Result<T, ResultError<FetchWithTokenErrorCode>[]>
   | Result<void, ResultError<FetchWithTokenErrorCode>[]>
 > {
+  const capabilities = getAppCapabilities();
+  if (!capabilities.cognition) {
+    if (url.includes('/mcp/servers') || url.includes('/pipedream/')) {
+      return ok([] as unknown as T);
+    }
+    return err([
+      {
+        type: 'FetchWithTokenError',
+        code: 'NETWORK_ERROR',
+        message: 'Cognition service is disabled in this profile',
+      },
+    ]) as Result<T, ResultError<FetchWithTokenErrorCode>[]>;
+  }
   const result = await fetchWithToken<T>(`${dcsHost}${url}`, init);
   if (result.isErr()) {
     if (url.includes('/mcp/servers')) {
diff --git a/apps/web/src/lib/service-clients/service-scheduled-action/client.ts b/apps/web/src/lib/service-clients/service-scheduled-action/client.ts
index 9b4a3288af6..2a66623f6ea 100644
--- a/apps/web/src/lib/service-clients/service-scheduled-action/client.ts
+++ b/apps/web/src/lib/service-clients/service-scheduled-action/client.ts
@@ -1,3 +1,4 @@
+import { getAppCapabilities } from '@core/constant/featureFlags';
 import { SERVER_HOSTS } from '@core/constant/servers';
 import {
   type FetchWithTokenErrorCode,
@@ -5,7 +6,7 @@ import {
 } from '@core/util/fetchWithToken';
 import type { ObjectLike, ResultError } from '@core/util/result';
 import type { SafeFetchInit } from '@core/util/safeFetch';
-import type { Result } from 'neverthrow';
+import { err, ok, type Result } from 'neverthrow';
 import type {
   ActionExecutionRecord,
   CreateScheduledAction,
@@ -30,6 +31,21 @@ function scheduledActionFetch<T extends ObjectLike = never>(
 ):
   | Promise<Result<T, ResultError<FetchWithTokenErrorCode>[]>>
   | Promise<Result<void, ResultError<FetchWithTokenErrorCode>[]>> {
+  const capabilities = getAppCapabilities();
+  if (!capabilities.scheduledActions) {
+    if (url.includes('/scheduled-actions')) {
+      return Promise.resolve(ok([] as unknown as T));
+    }
+    return Promise.resolve(
+      err([
+        {
+          type: 'FetchWithTokenError',
+          code: 'NETWORK_ERROR',
+          message: 'Scheduled action service is disabled in this profile',
+        },
+      ]) as Result<T, ResultError<FetchWithTokenErrorCode>[]>
+    );
+  }
   return fetchWithToken<T>(`${scheduledActionHost}${url}`, init);
 }
 
diff --git a/apps/web/src/lib/tauri/TauriProvider.tsx b/apps/web/src/lib/tauri/TauriProvider.tsx
index 3146f160033..0e425128578 100644
--- a/apps/web/src/lib/tauri/TauriProvider.tsx
+++ b/apps/web/src/lib/tauri/TauriProvider.tsx
@@ -1,5 +1,5 @@
 import { NativeAppUpdateRequiredDialog } from '@core/mobile/NativeAppUpdateRequiredDialog';
-import { isPlatform, isTauri } from '@core/util/platform';
+import { isTauri } from '@core/util/platform';
 import { PlatformNotificationProvider } from '@notifications';
 import type { RouteSectionProps } from '@solidjs/router';
 import { invoke } from '@tauri-apps/api/core';
diff --git a/docs/RUNNING_LOCALLY.md b/docs/RUNNING_LOCALLY.md
index 94e95b8cfda..f9bc2bdfe50 100644
--- a/docs/RUNNING_LOCALLY.md
+++ b/docs/RUNNING_LOCALLY.md
@@ -322,6 +322,8 @@ The app is served at `<proxy>/app/` (`http://localhost:8090/app` for the default
 
 It saves these volumes as an init snapshot. The snapshot is content-addressed and stored under `infra/local/generated/.snapshots`. Later runs restore the snapshot and skip the initialization. An input change causes a cache miss and a normal full init.
 
+When FusionAuth is restored from an existing volume, local startup still reapplies the env-backed admin account and Google/GitHub identity providers, so changing those credentials does not require deleting the FusionAuth volume.
+
 Useful commands:
 
 ```bash
diff --git a/infra/stacks/fusionauth-instance/README.md b/infra/stacks/fusionauth-instance/README.md
index 906df58a509..c07d865aa7b 100644
--- a/infra/stacks/fusionauth-instance/README.md
+++ b/infra/stacks/fusionauth-instance/README.md
@@ -30,6 +30,6 @@ password: set ADMIN_PASSWORD in your local/private .env
 api-key: bf69486b-4733-4954-a44e-2e1b5f2c8a91
 ```
 
-# TODO
-- [ ] configure idps
-- [ ] sync prod with pulumi stack
+# Maintenance
+- Use `just import_dev` or `just import_prod` once to adopt pre-existing FusionAuth state into Pulumi.
+- After import, use `pulumi up --stack [local|macro-inc/dev|macro-inc/prod]` for day-2 reconciliation.
diff --git a/infra/stacks/fusionauth-instance/index.ts b/infra/stacks/fusionauth-instance/index.ts
index 7cfe0b9c309..837890429eb 100644
--- a/infra/stacks/fusionauth-instance/index.ts
+++ b/infra/stacks/fusionauth-instance/index.ts
@@ -223,9 +223,9 @@ export const populateJwtLambdaId = populateJwtLambda.lambdaId;
 
 // Aborts Sign-in-with-Google when the id_token email differs from the FA user's
 // email — the signal that the link being matched was created by /link/gmail as a
-// secondary inbox, not the user's primary signup link. Must be wired to the
-// reconcile slot of the google_gmail IdP via FA admin UI per environment until
-// the IdP itself is declared in Pulumi.
+// secondary inbox, not the user's primary signup link. The google_gmail IdP is
+// now declared in Pulumi, so this reconcile lambda is attached by the stack
+// instead of being wired manually in the FusionAuth admin UI.
 const reconcileSecondaryIdpLinkLambda = new FusionAuthLambda(
   'reconcile-secondary-idp-link-lambda',
   {
diff --git a/infra/stacks/fusionauth-instance/justfile b/infra/stacks/fusionauth-instance/justfile
index 834d87d9277..ffb1be8e407 100644
--- a/infra/stacks/fusionauth-instance/justfile
+++ b/infra/stacks/fusionauth-instance/justfile
@@ -54,6 +54,16 @@ import_dev:
     fusionauth:index/fusionAuthIdpOpenIdConnect:FusionAuthIdpOpenIdConnect google-idp 17dc55db-c78e-4b19-940b-2e847479a08f \
     fusionauth:index/fusionAuthIdpOpenIdConnect:FusionAuthIdpOpenIdConnect google-gmail-idp b99932ac-bce5-4f1d-99a1-e64760aae811
 
+# Imports all pre-existing prod FusionAuth assets into pulumi.
+import_prod:
+  pulumi import --stack macro-inc/prod \
+    fusionauth:index/fusionAuthKey:FusionAuthKey jwt-signing-key 32bf13d6-8006-4a1f-b5e9-e8aa7b99922b \
+    fusionauth:index/fusionAuthApplication:FusionAuthApplication macro-application 75409999-7dc4-4241-b73b-a51818c3a71c \
+    fusionauth:index/fusionAuthTenant:FusionAuthTenant default-tenant a3e53c3d-8d6a-3e92-d64c-fa3bf30a60be \
+    fusionauth:index/fusionAuthLambda:FusionAuthLambda populate-jwt-lambda a7f3e8d2-4b91-4c5a-9e6f-1a2b3c4d5e6f \
+    fusionauth:index/fusionAuthIdpOpenIdConnect:FusionAuthIdpOpenIdConnect google-idp 3707ffc1-c785-4537-a537-10c9ba363e1e \
+    fusionauth:index/fusionAuthIdpOpenIdConnect:FusionAuthIdpOpenIdConnect google-gmail-idp 33fbd135-08c1-4975-8987-cf2456752c2d
+
 # Performs a healthcheck on local FusionAuth.
 healthcheck:
   @echo "Waiting for FusionAuth to be healthy..."
diff --git a/justfile b/justfile
index 1191ad1ce91..d3ab2732b2b 100644
--- a/justfile
+++ b/justfile
@@ -78,6 +78,36 @@ local-e2e-services := "authentication-service connection_gateway contacts_servic
 self-host-check:
   python3 self-host/scripts/check-drift.py
 
+# Fast local contract checks for the self-host Email production profile.
+email-contract-check: email-profile-check
+
+# Verify Compose/Caddy/resource/profile drift and the Nix self-host Email graph.
+email-profile-check:
+  #!/usr/bin/env bash
+  set -euo pipefail
+  command -v nix >/dev/null || {
+    echo "nix is required for Email profile contract checks" >&2
+    exit 127
+  }
+  python3 self-host/scripts/check-drift.py
+  python3 self-host/scripts/affected-services.py --all
+  nix build --dry-run .#self-host-email-source-check
+  nix build --dry-run .#self-host-email-binaries
+
+# Focused backend compile contract for the Email production aggregate.
+email-backend-check:
+  #!/usr/bin/env bash
+  set -euo pipefail
+  command -v nix >/dev/null || {
+    echo "nix is required for Email backend contract checks" >&2
+    exit 127
+  }
+  nix build .#self-host-email-binaries
+
+# Frontend test contract for Email UI and shared web code.
+email-web-check:
+  just apps/web/test
+
 # Update the fixed-output js node_modules hash after bun.lock changes.
 update-node-modules-hash:
   tooling/scripts/update-node-modules-hash.sh
diff --git a/nix/cloud-storage.nix b/nix/cloud-storage.nix
index f2e24131b19..a32ba5e68c3 100644
--- a/nix/cloud-storage.nix
+++ b/nix/cloud-storage.nix
@@ -481,7 +481,6 @@
           serviceName = "document-storage-service";
           packageName = "document_storage_service";
           binaries = [ "document_storage_service" ];
-          featureArgs = "--no-default-features";
         }
         {
           serviceName = "email-service";
@@ -557,7 +556,6 @@
       # Same --no-default-features stripping as selfHostEmailBinaryCargoExtraArgs:
       # cargo rejects the flag when it appears more than once, and the aggregate
       # deps-only command concatenates featureArgs from every definition.
-      # Currently only DSS uses the flag here, but a second package would break.
       deployBinaryCargoExtraArgs =
         "--locked "
         + pkgs.lib.concatMapStringsSep " " (
@@ -690,7 +688,6 @@
           serviceName = "document-storage-service";
           packageName = "document_storage_service";
           binaries = [ "document_storage_service" ];
-          featureArgs = "--no-default-features";
         }
         {
           serviceName = "email-service";
diff --git a/self-host/Caddyfile b/self-host/Caddyfile
index 0b214f04c50..c149baf6a33 100644
--- a/self-host/Caddyfile
+++ b/self-host/Caddyfile
@@ -151,7 +151,10 @@ http://{$FUSIONAUTH_DOMAIN} {
 		X-Content-Type-Options "nosniff"
 		-Server
 	}
-	reverse_proxy fusionauth:9011
+	reverse_proxy fusionauth:9011 {
+		header_up X-Forwarded-Proto "https"
+		header_up X-Forwarded-Port "443"
+	}
 }
 
 http://{$S3_DOMAIN} {
diff --git a/self-host/docker-compose.yml b/self-host/docker-compose.yml
index 01704f396ff..d4a4039a7a4 100644
--- a/self-host/docker-compose.yml
+++ b/self-host/docker-compose.yml
@@ -65,7 +65,22 @@ services:
   # One-shot: unpack the built frontend bundle into the volume Caddy serves.
   web_assets:
     image: ${MACRO_IMAGE_WEB:-ghcr.io/kevinlaucn/macro-web}:${MACRO_VERSION:?set MACRO_VERSION in .env}
-    command: ["sh", "-c", "rm -rf /out/* && cp -a /srv/frontend/. /out/"]
+    command:
+      - "sh"
+      - "-c"
+      - |
+        rm -rf /out/* && cp -a /srv/frontend/. /out/
+        cat <<EOF > /out/env-config.js
+        window.__MACRO_ENV__ = {
+          ADMIN_EMAIL: "$${ADMIN_EMAIL:-}",
+          FEATURES: {
+            cognition: false,
+            scheduledActions: false,
+            agents: false,
+            docsCollab: false
+          }
+        };
+        EOF
     volumes:
       - web_assets:/out
     restart: "no"
@@ -146,7 +161,7 @@ services:
   redis:
     image: redis/redis-stack-server:7.4.0-v3
     restart: unless-stopped
-    command: ["redis-server", "--appendonly", "yes", "--save", "60", "1"]
+    command: ["redis-server", "--protected-mode", "no", "--appendonly", "yes", "--save", "60", "1"]
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 10s
diff --git a/self-host/email-capabilities.json b/self-host/email-capabilities.json
new file mode 100644
index 00000000000..9eb11cacc14
--- /dev/null
+++ b/self-host/email-capabilities.json
@@ -0,0 +1,10 @@
+{
+  "email": true,
+  "contacts": true,
+  "dss": true,
+  "notification": true,
+  "websocket": true,
+  "cognition": false,
+  "scheduled_actions": false,
+  "ai_editing": false
+}
diff --git a/self-host/images/Dockerfile.services b/self-host/images/Dockerfile.services
index fd12411707d..89afecb47a2 100644
--- a/self-host/images/Dockerfile.services
+++ b/self-host/images/Dockerfile.services
@@ -19,7 +19,7 @@ LABEL org.opencontainers.image.title="Macro services" \
       org.opencontainers.image.version="${MACRO_VERSION}"
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-      ca-certificates dumb-init curl \
+      ca-certificates dumb-init curl patchelf \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # An unprivileged runtime user. Package installation and the copy below still
@@ -30,8 +30,9 @@ RUN groupadd --system --gid 10001 macro \
 WORKDIR /app
 COPY ${BIN_DIR}/ /app/out/
 # Binaries stay owned by root and world-executable: the service user runs them
-# but must not be able to rewrite them.
-RUN chmod 0755 /app/out/*
+# but must not be able to rewrite them. Set Debian glibc dynamic linker since
+# nix build hardcodes the nix store interpreter.
+RUN patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 /app/out/* && chmod 0755 /app/out/*
 
 # Services listen here; only the reverse proxy is published to the host.
 # Above 1024, so binding needs no privileges.
diff --git a/self-host/init/provision.sh b/self-host/init/provision.sh
index 809033fb2e4..4cf0a092e35 100755
--- a/self-host/init/provision.sh
+++ b/self-host/init/provision.sh
@@ -71,6 +71,34 @@ fi
 log "applying migrations"
 macro_db_migrate
 
+if [ -n "${ADMIN_EMAIL:-}" ]; then
+  log "ensuring Super Administrator exists ($ADMIN_EMAIL)"
+  psql -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -d "$PGDATABASE" -v ON_ERROR_STOP=1 -v admin_email="$ADMIN_EMAIL" <<'ADMIN_EOF' >/dev/null
+INSERT INTO "macro_user" ("id", "username", "email", "stripe_customer_id", "has_trialed")
+VALUES ('00000000-0000-0000-0000-000000000001'::uuid, 'admin', :'admin_email', 'cus_local_admin', true)
+ON CONFLICT ("id") DO UPDATE
+SET "username" = 'admin',
+    "email" = EXCLUDED."email",
+    "stripe_customer_id" = EXCLUDED."stripe_customer_id";
+
+INSERT INTO "User" ("id", "email", "name", "macro_user_id", "aiDataConsent", "tutorialComplete")
+VALUES ('macro|' || :'admin_email', :'admin_email', 'Admin', '00000000-0000-0000-0000-000000000001'::uuid, true, true)
+ON CONFLICT ("id") DO UPDATE
+SET "email" = EXCLUDED."email",
+    "macro_user_id" = EXCLUDED."macro_user_id";
+
+INSERT INTO "RolesOnUsers" ("userId", "roleId")
+VALUES
+  ('macro|' || :'admin_email', 'super_admin'),
+  ('macro|' || :'admin_email', 'ai_subscriber'),
+  ('macro|' || :'admin_email', 'sub_opus'),
+  ('macro|' || :'admin_email', 'editor_user'),
+  ('macro|' || :'admin_email', 'email_tool'),
+  ('macro|' || :'admin_email', 'professional_subscriber')
+ON CONFLICT ("userId", "roleId") DO NOTHING;
+ADMIN_EOF
+fi
+
 # ---------------------------------------------------------------------------
 step "Object storage"
 # ---------------------------------------------------------------------------
diff --git a/self-host/init/render-kickstart.sh b/self-host/init/render-kickstart.sh
index 3c638a69d48..e3239943ec5 100755
--- a/self-host/init/render-kickstart.sh
+++ b/self-host/init/render-kickstart.sh
@@ -86,15 +86,15 @@ append_requests() {
 }
 
 if configured "${GOOGLE_CLIENT_ID:-}" && configured "${GOOGLE_CLIENT_SECRET_KEY:-}"; then
-  reconcile_body=$(esc "$(cat /app/kickstart-templates/reconcile_secondary_idp_link.js)")
+  reconcile_body=$(cat /app/kickstart-templates/reconcile_secondary_idp_link.js)
   google=$(subst "$TPL/idp-google.json.template" \
     GOOGLE_IDP_ID            "$(esc "$GOOGLE_IDP_ID")" \
     GOOGLE_GMAIL_IDP_ID      "$(esc "$GOOGLE_GMAIL_IDP_ID")" \
     RECONCILE_LAMBDA_ID      "$(esc "$RECONCILE_LAMBDA_ID")" \
-    RECONCILE_LAMBDA_BODY    "$reconcile_body" \
     GOOGLE_CLIENT_ID         "$(esc "$GOOGLE_CLIENT_ID")" \
     GOOGLE_CLIENT_SECRET_KEY "$(esc "$GOOGLE_CLIENT_SECRET_KEY")" \
     FUSIONAUTH_CLIENT_ID     "$(esc "$FUSIONAUTH_CLIENT_ID")")
+  google=$(printf '%s' "$google" | jq --arg rb "$reconcile_body" '.[0].body.lambda.body = $rb')
   append_requests "$google"
   echo "  google identity providers: configured"
 else
diff --git a/self-host/scripts/check-drift.py b/self-host/scripts/check-drift.py
index d7ad0336903..0d2b6f64f5d 100644
--- a/self-host/scripts/check-drift.py
+++ b/self-host/scripts/check-drift.py
@@ -101,6 +101,7 @@ def field(name):
 
 # --- resources -------------------------------------------------------------
 manifest = json.loads((SELF_HOST / "init/resources.json").read_text())
+email_capabilities = json.loads((SELF_HOST / "email-capabilities.json").read_text())
 env_keys = {
     line.split("=", 1)[0]
     for line in env_example.splitlines()
@@ -186,6 +187,26 @@ def field(name):
 # --- image and profile invariants ------------------------------------------
 workflow = (ROOT / ".github/workflows/self-host-images.yml").read_text()
 
+expected_email_capabilities = {
+    "email": True,
+    "contacts": True,
+    "dss": True,
+    "notification": True,
+    "websocket": True,
+    "cognition": False,
+    "scheduled_actions": False,
+    "ai_editing": False,
+}
+if email_capabilities != expected_email_capabilities:
+    fail(
+        "self-host/email-capabilities.json must stay the Email production "
+        f"capability contract; found {email_capabilities!r}"
+    )
+
+document_storage_api = (ROOT / "services/document_storage_service/src/api.rs").read_text()
+if 'mod items;' not in document_storage_api or '.nest("/items"' not in document_storage_api:
+    fail("document_storage_service must expose /dss/items for the Email web UI")
+
 # Ensure macro_db_migrate is part of the binary graph
 if 'packageName = "macro_db_migrator";' not in (ROOT / "nix/cloud-storage.nix").read_text():
     fail("macro_db_migrator is not part of the Nix-managed self-host binary graph")
@@ -205,10 +226,33 @@ def field(name):
     if not match or 'profiles: ["full"]' not in match.group(1):
         fail(f"{service} must stay behind the full Compose profile")
 
+web_assets_match = re.search(r"^  web_assets:\n(.*?)(?=^  \w|^volumes:)", compose, re.M | re.S)
+if not web_assets_match:
+    fail("web_assets service missing from docker-compose.yml")
+else:
+    web_assets = web_assets_match.group(1)
+    for flag in ("cognition", "scheduledActions", "agents", "docsCollab"):
+        if f"{flag}: false" not in web_assets:
+            fail(f"Email profile web runtime config must set FEATURES.{flag} to false")
+
 for image in ("macro-ai-editing-worker", "macro-analytics-proxy"):
     if image in workflow:
         fail(f"{image} must not be built by the Email production image workflow")
 
+# --- FusionAuth / Google IdP contract --------------------------------------
+render_kickstart = (SELF_HOST / "init/render-kickstart.sh").read_text()
+google_idp_template = (SELF_HOST / "kickstart/idp-google.json.template").read_text()
+if 'configured "${GOOGLE_CLIENT_ID:-}" && configured "${GOOGLE_CLIENT_SECRET_KEY:-}"' not in render_kickstart:
+    fail("render-kickstart.sh must only render Google IdPs when real credentials are configured")
+if "append_requests \"$google\"" not in render_kickstart:
+    fail("render-kickstart.sh must append rendered Google IdP requests to kickstart.json")
+if '"name": "google"' not in google_idp_template:
+    fail("Google sign-in IdP template is missing the google identity provider")
+if '"name": "google_gmail"' not in google_idp_template:
+    fail("Google Gmail IdP template is missing google_gmail")
+if '"lambdaConfiguration": { "reconcileId": "@@RECONCILE_LAMBDA_ID@@" }' not in google_idp_template:
+    fail("google_gmail IdP must wire the reconcile lambda")
+
 # --- kafka -----------------------------------------------------------------
 # Required Kafka topics for self-host email must exist in self-host/init/kafka-topics.json
 topics_src = set(json.loads((ROOT / ".github/kafka-cluster-topics.json").read_text()))