diff --git a/CHANGELOG.md b/CHANGELOG.md
index 160318854..81c525755 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,18 @@ All notable changes to this project are documented in this file. The format is b
 ## [Unreleased]
 
 ### Added
+- `AuditLink.for_model(Model, url_template=..., ...)` fills `entity_type` (class
+  name) and `table_name` from the model; every module's `register_audit_links`
+  now uses it. `simple_module_db.independent_session(app)` is an async context
+  manager for out-of-request sessions that commits on success and rolls back on
+  error (`permissions` startup replay and `api_tokens` last-used write use it)
+  (#523).
+- Framework pagination helper (#513): `simple_module_db.PageParams`, `Page` and
+  `async paginate(session, stmt, params)` (clamps to the last page, never a
+  negative offset, counts through soft-delete/tenant filters), `clamp_page` /
+  `total_pages`; `simple_module_hosting.pagination` adds the strict
+  `page_params(n)` and clamping `lenient_page_params(n)` dependencies; and a
+  `PaginationBar` component in `@simple-module-py/ui` (`ui.pagination.*` keys).
 - New `mail` module (`simple_module_mail`) owns outgoing mail: the SMTP/console
   transport, its settings (`/admin/settings/`, package `mail`) and the on-demand
   `mail.mailer` health check behind "Test mailer connection". Modules send through
@@ -39,6 +51,35 @@ All notable changes to this project are documented in this file. The format is b
   it, which removes the `users` ↔ `audit_log` import cycle.
 
 ### Changed
+- Bound FastAPI to `>=0.140,<0.157` in framework and module dependencies; a
+  contract test guards the route guard's private FastAPI/Starlette APIs (#516).
+- Declare and document the optional `file_storage[tasks]` extra for the lockstep
+  background-tasks package; document `DurableTransport` as the durable-event
+  extension point and verify uploads without background tasks (#502).
+- Users, file_storage, background_tasks (executions and outbox), audit_log,
+  settings and tenants lists now share the pagination helpers instead of
+  per-module copies (#513). Browser view routes (`background_tasks`
+  including the outbox page, `file_storage`, `tenants` admin, `users` admin) clamp
+  `?page=0`/negative/garbage to page 1 rather than reject; every JSON list API
+  (`background_tasks` executions and outbox, `audit_log`, `file_storage`,
+  `users` admin) answers 422 for `page` outside 1..1,000,000 and `per_page`
+  outside 1..200, where some used to accept `page=0` or an unbounded `per_page`
+  or forward a huge page to SQL as an out-of-range offset. The outbox API now
+  reports the clamped page when asked past the end. The audit log, executions
+  and outbox tables use `PaginationBar`; their private `showing/previous/next`
+  locale keys are removed in favour of `ui.pagination.*`.
+- One module scaffolder (#509). `make new-module` now calls the CLI's
+  `create_module` (`framework_repo=True` overlay) instead of ~980 lines of
+  f-string templates in `scripts/_templates_*.py`, which are deleted, so
+  `smpy create-module` / `smpy new` and `make new-module` share one set of
+  `templates/module/` files. Both now emit `constants.py`, `models.py`,
+  `contracts/`, `service.py`, `deps.py`, permission-guarded REST + Inertia
+  endpoints, Browse/Create/Edit pages, a menu item with `label_key`,
+  `register_permissions`, `locale_dirs` and `locales/en.json` (the CLI sample
+  page `Index.tsx` is replaced by `Browse.tsx`). `make new-module` also adds
+  the module to the `publish-pypi` matrix and runs `npm install` and
+  `make gen-i18n`; a fresh module passes `make lint`. The scaffold tests live in
+  `framework/cli/tests/` only.
 - `audit_log` and `dashboard` no longer depend on `Users` (meta `depends_on`
   and package dependency); `background_tasks` drops its unused `Users`
   dependency (#501). `api_tokens` moves `Users` to `optional_depends_on` and
diff --git a/CLAUDE.md b/CLAUDE.md
index fdc1e9204..9bb0ed149 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -131,13 +131,13 @@ The Python package name (`feature_flags`) keys the i18n namespace,
 the namespace is the meta name.
 
 **Module layout** (`make new-module` scaffolds the files below except
-`constants.py`, `tasks.py` and the CSS, plus `pyproject.toml`, `README.md`,
-`LICENSE`, `package.json`, `tsconfig.json`, `tests/`):
+`tasks.py` and the CSS, plus `pyproject.toml`, `README.md`, `LICENSE`,
+`package.json`, `tsconfig.json`, `tests/`):
 
 ```
 modules/<name>/<name>/
 ├── module.py          # ModuleBase subclass, meta = ModuleMeta(...)
-├── constants.py       # add it: PERM_*, ROLE_*, _PAGE_*, _MODULE_* — see § Conventions
+├── constants.py       # PERM_*, PAGE_*, MENU_*, ROLE_*, _MODULE_* — see § Conventions (scaffolded)
 ├── models.py          # SQLModel tables (table=True)
 ├── contracts/         # SQLModel DTOs — the public surface; add a Protocol only for real extension points
 ├── settings.py        # DbBackedSettings subclass
@@ -371,8 +371,9 @@ development and testing (`session_cookie_secure`).
   durable handlers, which have no app). The `mail` module owns SMTP and its
   settings; without it the sender only logs (`delivers_email` is false). Tests
   use the `captured_mail` fixture.
-- **Audit links / design packs**: `register_audit_links` takes
-  `AuditLink(entity_type=Model.__name__, …)` (class name, not table name, or it
+- **Audit links / design packs**: `register_audit_links` builds
+  links with `AuditLink.for_model(Model, url_template=…, …)` (it fills
+  `entity_type=Model.__name__` and `table_name`; a table-name `entity_type`
   silently never matches); `register_design_packs` slugs must match
   `^[a-z0-9][a-z0-9-]*$` and the host must still import the CSS.
 - **i18n.** Ship `<package>/locales/<lang>.json`, declare in `locale_dirs()` with
@@ -407,23 +408,35 @@ development and testing (`session_cookie_secure`).
 
 ## Adding a module or package
 
-`make new-module name=<name>` scaffolds the package, wires it into
-`host/pyproject.toml` and the root `testpaths`/`extra-paths`, and runs
-`uv sync`. Expect `make lint` to fail right after: the scaffold still emits a
-literal `inertia.render("<Class>/Create")` and permission and menu strings
-without constants or `label_key`. Fix those first. It also does **not**:
-
-1. Run `npm install`, so regenerate and commit `package-lock.json` (CI uses
-   `npm ci`). Commit the `uv.lock` change the scaffold's
-   `uv sync` makes too (CI uses `uv sync --locked`).
-2. Add `simple_module_<name>` to the `publish-pypi` matrix in
-   `.github/workflows/release.yml`; a test and `check_metadata.py` fail until
-   you do. `pyproject.toml` needs description, `readme`, `license = "MIT"`,
-   keyword `simple-module`, `urls.Repository`; `README.md` needs ≥ 500 bytes, an
-   H1 and Install/Usage sections.
+There is **one scaffolder**: `make new-module name=<name>` runs
+`scripts/new_module.py`, a thin wrapper over the CLI's
+`simple_module_cli.scaffolding.create_module(..., framework_repo=True)`, the same
+templates `smpy create-module` / `smpy new` use
+(`framework/cli/simple_module_cli/templates/module/`). Change a convention there,
+once. The `framework_repo` variant is a template overlay
+(`_optional/framework_repo/`: workspace-sourced `pyproject.toml` with the
+`check_metadata.py` fields, `LICENSE`, `README.md`, i18n-keyed pages).
+
+It generates a CRUD sample (model, DTOs, service, REST + Inertia endpoints,
+Browse/Create/Edit pages, `locales/en.json`, tests) whose permissions, page keys
+and menu item come from `constants.py` (`label_key` set, routes guarded), so a
+fresh module passes `make lint`. Then
+`simple_module_cli.framework_repo.wire_module` adds it to `host/pyproject.toml`,
+the root `testpaths`/`extra-paths` and the `publish-pypi` matrix in
+`release.yml`, and the target runs `uv sync --all-packages`, `npm install` and
+`make gen-i18n`. Commit the resulting `uv.lock`, `package-lock.json` and
+`packages/i18n/src/{keys.generated,generated-resources}.ts` changes (CI uses
+`--locked` / `npm ci` and diffs the i18n files). It does **not**:
+
+1. Create a migration for the sample table: edit `models.py`, then follow
+   § Database (`--head <label>@head`, set `branch_labels` on the first
+   revision). `make doctor` reports `SM011` until you do.
+2. Register a PyPI pending publisher for the new `simple_module_<name>`
+   (manual; the release leg 403s without it).
 3. Write `docs/modules/<name>.md`, add it to `docs/modules/index.md` and the
    VitePress sidebar in `docs/.vitepress/config.ts`.
-4. Set `branch_labels` on the first migration, or add a `CHANGELOG.md` entry.
+4. Add a `CHANGELOG.md` entry, or add the module to the e2e/perf
+   `SM_MODULES_ENABLED` lists if those jobs should exercise it.
 
 A new `framework/*` package is wired by hand: root `pyproject.toml`
 `testpaths` + `[tool.ty.environment].extra-paths` and the `publish-pypi`
diff --git a/Makefile b/Makefile
index 682d05aa7..77e5619d8 100644
--- a/Makefile
+++ b/Makefile
@@ -255,6 +255,8 @@ new-module:                 ## Scaffold a new module (usage: make new-module nam
 	@test -n "$(name)" || (echo "Error: Please provide a module name, e.g. make new-module name=orders" && exit 1)
 	uv run python scripts/new_module.py $(name)
 	uv sync --all-packages
+	npm install
+	$(MAKE) gen-i18n
 
 # Kill dev servers
 kill:
diff --git a/README.md b/README.md
index e6e6ce40e..330ffb3a0 100644
--- a/README.md
+++ b/README.md
@@ -152,7 +152,7 @@ packages/
   ui/          # shared shadcn/ui components, layouts, and design-system primitives
   i18n/        # generated i18n keys + translation runtime
 scripts/
-  new_module.py  # module scaffolder (called by `make new-module`)
+  new_module.py  # thin wrapper over the CLI scaffolder (`make new-module`)
 docs/
   plans/                      # design + implementation plans
   framework-conventions.md    # invariants for module authors
diff --git a/docs/.vitepress/config.ts b/docs/.vitepress/config.ts
index 69dc90d19..bb656edaa 100644
--- a/docs/.vitepress/config.ts
+++ b/docs/.vitepress/config.ts
@@ -142,6 +142,7 @@ export default defineConfig({
             { text: "Per-module Base", link: "/database/per-module-base" },
             { text: "Mixins", link: "/database/mixins" },
             { text: "Session lifecycle", link: "/database/sessions" },
+            { text: "Pagination", link: "/database/pagination" },
             { text: "Migrations", link: "/database/migrations" },
             { text: "Extensions and column types", link: "/database/extensions" },
           ],
diff --git a/docs/database/pagination.md b/docs/database/pagination.md
new file mode 100644
index 000000000..b1dbaf0d9
--- /dev/null
+++ b/docs/database/pagination.md
@@ -0,0 +1,36 @@
+# Pagination
+
+One helper clamps, counts and slices, so every list agrees on what `?page=0`
+or a page past the end means.
+
+```python
+from simple_module_db import PageParams, paginate
+from simple_module_hosting.pagination import page_params
+
+
+# JSON API: page < 1 or per_page outside 1..200 is a 422.
+@router.get("/", response_model=None)
+async def list_orders(
+    params: PageParams = Depends(page_params(default_per_page=50)),
+    db: AsyncSession = Depends(get_db),
+):
+    page = await paginate(db, select(Order).order_by(Order.id), params)
+    return page  # items, total, page, per_page, pages
+```
+
+- `PageParams(page, per_page)` lives in `simple_module_db` (no FastAPI import).
+  It normalises on construction (`page >= 1`, `1 <= per_page <= 200`), so
+  `.offset` is never negative. `simple_module_hosting.pagination` builds it from
+  the query string: `page_params(n)` is strict (422), `lenient_page_params(n)` /
+  `LenientPageParamsDep` clamp garbage instead, for Inertia views reached from
+  bookmarked URLs.
+- `paginate(session, stmt, params, scalars=True)` counts `stmt` as a subquery,
+  so soft-delete and tenant filters apply to the count exactly as to the rows.
+  `stmt` needs its own `ORDER BY`. A page past the end is clamped to the last
+  page and the returned `page` is the one served. Pass `scalars=False` for
+  multi-column selects (items are rows).
+- Queries that cannot use `paginate` (a window-function total, a service that
+  counts separately) still share `clamp_page(page, total, per_page)`,
+  `total_pages(total, per_page)` and `PageParams.offset`.
+- Frontend: `PaginationBar` from `@simple-module-py/ui/components/PaginationBar`
+  takes `page`, `perPage`, `total`, `onPageChange` (the `Page` shape).
diff --git a/docs/database/sessions.md b/docs/database/sessions.md
index 2cea3ea2f..5b1b65bf9 100644
--- a/docs/database/sessions.md
+++ b/docs/database/sessions.md
@@ -133,6 +133,21 @@ async def worker(db: DatabaseState):
 
 The `async with session.begin()` pattern opens a transaction you control. Use it in code that runs **outside** a request scope.
 
+### `independent_session(app)`
+
+For the common case, a short unit of work outside the request that should commit when it succeeds and roll back when it fails, use `independent_session`:
+
+```python
+from simple_module_db import independent_session
+
+
+async def on_startup(self, app):
+    async with independent_session(app) as db:
+        await replay_rows(db)  # committed on clean exit, rolled back on error
+```
+
+It opens a session from `app.state.sm.db.session_factory`, commits when the block exits cleanly, and rolls back and re-raises otherwise. Do not call `commit()` inside the block. Keep using `session_factory()` directly when the block is read-only, must commit mid-way (for example to do follow-up work after the commit, as the branding image reaper does), or runs against another engine.
+
 ## Sessions and `MultiTenantMixin`
 
 The active tenant is carried in the `current_tenant_id` contextvar (set by `TenantMiddleware`, not on the session). The tenant listeners read that contextvar to filter SELECTs and stamp INSERTs. Sessions stay **request-scoped** so they always run under the request's tenant context — sharing one across tenants would silently leak data.
diff --git a/docs/framework-conventions.md b/docs/framework-conventions.md
index 8f0688752..2715b80ed 100644
--- a/docs/framework-conventions.md
+++ b/docs/framework-conventions.md
@@ -20,7 +20,7 @@ modules/<name>/
     └── pages/                # *.tsx — auto-discovered by Vite
 ```
 
-Scaffold a fresh module with `smpy create-module <name> --dest modules/<name>` — it generates a working subset (`module.py`, `services.py`, `settings.py`, `endpoints/api.py`, an empty `pages/`, plus packaging files); add `models.py`, `deps.py`, `contracts/`, `endpoints/views.py`, and `locales/` as your module needs them. Then run `uv add ./modules/<name>` to register it on your app.
+Scaffold a fresh module with `smpy create-module <name> --dest modules/<name>` — it generates a working CRUD sample (`module.py`, `constants.py`, `models.py`, `contracts/`, `service.py`, `deps.py`, `settings.py`, `services.py`, `endpoints/{api,views}.py`, `pages/{Browse,Create,Edit}.tsx`, `locales/en.json`, plus packaging files and tests). `make new-module` uses the same templates for a module inside this repo. Then run `uv add ./modules/<name>` to register it on your app.
 
 ## ModuleMeta
 
@@ -621,7 +621,7 @@ class OrdersModule(ModuleBase):
         return {"orders": Path(str(importlib.resources.files(__package__) / "locales"))}
 ```
 
-Add this method (and a matching `locales/en.json`) yourself — the `smpy create-module` scaffold does not emit a `locales/` directory.
+The `smpy create-module` / `make new-module` scaffold emits this method and a starter `locales/en.json`; add it yourself only for a hand-rolled module.
 
 ### Key naming
 
diff --git a/docs/framework/events.md b/docs/framework/events.md
index 4447825ab..95608b9aa 100644
--- a/docs/framework/events.md
+++ b/docs/framework/events.md
@@ -1,6 +1,6 @@
 # Events
 
-`EventBus` is an **in-process** pub/sub mechanism. `publish` is not a message broker — no persistence, no retries, no cross-process delivery. For events that must be handled even across a crash, use [durable delivery](#durable-delivery) (`subscribe_durable` / `publish_durable`), which the `background_tasks` module backs with an outbox. To tell *other worker processes* that something they cached is stale, use the [invalidation bus](/framework/invalidation) instead — same shape, deliberately narrower contract.
+`EventBus` is an **in-process** pub/sub mechanism. `publish` is not a message broker — no persistence, no retries, no cross-process delivery. For events that must be handled even across a crash, use [durable delivery](#durable-delivery) (`subscribe_durable` / `publish_durable`), through the `DurableTransport` protocol extension point. The framework ships an outbox implementation in `background_tasks`. To tell *other worker processes* that something they cached is stale, use the [invalidation bus](/framework/invalidation) instead — same shape, deliberately narrower contract.
 
 Events are the preferred way for modules to react to **other modules'** actions without creating a direct code dependency.
 
@@ -186,7 +186,7 @@ await bus.publish_durable(OrderPlaced(order_id=order.id, ...), db)
   `register_event_handlers(bus, None)` — subscribe durably *before* any early
   `return` taken when `app is None`.
 
-`DurableTransport` is a protocol (`async enqueue(event, handler_names, db)`), so
+`DurableTransport` (`simple_module_core.durable_events`) is the extension point: a protocol (`async enqueue(event, handler_names, db)`), so
 another module could provide one; `background_tasks` is the shipped
 implementation — see [its docs](/modules/background_tasks#durable-events-outbox)
 for the outbox, retries, the admin page and the worker side.
diff --git a/docs/framework/lifecycle.md b/docs/framework/lifecycle.md
index 7e7b7ca07..a7b076dcf 100644
--- a/docs/framework/lifecycle.md
+++ b/docs/framework/lifecycle.md
@@ -272,8 +272,8 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
     from users.models import User
 
     registry.register(
-        AuditLink(
-            entity_type=User.__name__,  # class name — NOT __tablename__
+        AuditLink.for_model(
+            User,  # fills entity_type=User.__name__ (NOT __tablename__) and table_name
             url_template="/admin/users/{id}",
             label="User",
             label_key="users.audit.user",
@@ -281,7 +281,7 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
     )
 ```
 
-`entity_type` matches `AuditEntry.entity_type`, which `snapshot_changes` writes as `type(obj).__name__`. Keying it off `__tablename__` (`"users_user"`) produces a link that never matches — and nothing errors: an unmatched lookup falls back to rendering `entity_type` as a plain label, so the row still shows text while silently never becoming a link. Using `Model.__name__` rather than a string literal makes a rename impossible to get wrong.
+`entity_type` matches `AuditEntry.entity_type`, which `snapshot_changes` writes as `type(obj).__name__`. Keying it off `__tablename__` (`"users_user"`) produces a link that never matches — and nothing errors: an unmatched lookup falls back to rendering `entity_type` as a plain label, so the row still shows text while silently never becoming a link. `AuditLink.for_model(Model, ...)` fills `entity_type` from `Model.__name__` and `table_name` from `Model.__tablename__`, so a rename or a table-name mix-up is impossible; the plain `AuditLink(...)` constructor stays available for links without a model class.
 
 `url_template` must contain the literal `{id}` placeholder, substituted with the entity id. A template without it raises at boot rather than pointing every row at the same page.
 
diff --git a/docs/modules/file_storage.md b/docs/modules/file_storage.md
index 6bacb022a..43d372b99 100644
--- a/docs/modules/file_storage.md
+++ b/docs/modules/file_storage.md
@@ -2,6 +2,14 @@
 
 Pluggable file storage with two shipped backends — local filesystem and S3-compatible — plus a browse / upload / download admin UI. Backend selection is per-deployment (DB-backed setting), so you can switch from `filesystem` (dev / single-node) to `s3` (prod) without code changes.
 
+Install `simple_module_file_storage[tasks]` to include the matching
+`simple_module_background_tasks` package, then enable `background_tasks` and run
+its worker for asynchronous multipart-upload checksums. Run its beat scheduler
+as well for upload cleanup jobs.
+The extras combine as `simple_module_file_storage[s3,tasks]`. Without
+`background_tasks`, uploads still work; completed multipart uploads keep
+`checksum_sha256` null. Streamed uploads compute their checksum inline.
+
 ## ModuleMeta
 
 | Field | Value |
@@ -250,8 +258,8 @@ The audit-log label resolver names files across tenants on purpose: the audit
 log is a platform screen over every tenant's entries, each of which already
 records the filename.
 
-The module has no background jobs, sweeps or CLI commands. Anything added
-later that touches `StoredFile` outside a request must run under
+The optional checksum task and upload reaper use the background-tasks worker.
+Any task that touches `StoredFile` outside a request must run under
 `tenant_context(row.tenant_id)` for per-tenant work, or `all_tenants()` for a
 deliberate platform-wide sweep.
 
diff --git a/framework/cli/simple_module_cli/case.py b/framework/cli/simple_module_cli/case.py
index 992c888b3..ed1c2d192 100644
--- a/framework/cli/simple_module_cli/case.py
+++ b/framework/cli/simple_module_cli/case.py
@@ -13,6 +13,7 @@
     "InvalidScaffoldNameError",
     "to_kebab_case",
     "to_pascal_case",
+    "to_singular",
     "to_snake_case",
     "validate_scaffold_name",
 ]
@@ -60,6 +61,31 @@ def to_pascal_case(name: str) -> str:
     return "".join(part.capitalize() for part in snake.split("_") if part)
 
 
+_UNCOUNTABLE = frozenset({"news", "status", "series", "species", "data"})
+_ES_SUFFIXES = ("uses", "sses", "xes", "ches", "shes")
+
+
+def to_singular(snake: str) -> str:
+    """Conservative singularization of a snake_case name: 'orders' -> 'order'.
+
+    Only the last ``_`` segment is inflected. Handles ``ies`` -> ``y`` and
+    ``uses``/``xes``/``ches``/``shes``/``sses`` -> drop ``es``; leaves ``ss``/``us``/``is``
+    endings and a few uncountables alone; otherwise drops one trailing ``s``.
+    The author renames the sample entity when this guesses wrong.
+    """
+    head, sep, word = snake.rpartition("_")
+    if word in _UNCOUNTABLE or not word.endswith("s") or word.endswith(("ss", "us", "is")):
+        return snake
+    # Irregular -ie plurals ("movies", "cookies") are not handled: "ies" -> "y".
+    if word.endswith("ies") and len(word) > 3:
+        word = word[:-3] + "y"
+    elif word.endswith(_ES_SUFFIXES):
+        word = word[:-2]
+    else:
+        word = word[:-1]
+    return head + sep + word
+
+
 _VALID_NAME_RE = re.compile(r"^[a-z][a-z0-9]*(?:[_-][a-z0-9]+)*$")
 
 
diff --git a/framework/cli/simple_module_cli/framework_repo.py b/framework/cli/simple_module_cli/framework_repo.py
new file mode 100644
index 000000000..666cae546
--- /dev/null
+++ b/framework/cli/simple_module_cli/framework_repo.py
@@ -0,0 +1,127 @@
+"""Wire a module scaffolded inside the simple_module_python monorepo.
+
+``make new-module`` (via ``scripts/new_module.py``) scaffolds with
+``create_module(..., framework_repo=True)`` and then calls
+:func:`wire_module` so the new workspace member is a dependency of the dev
+host and is collected by pytest and type-checked by ``ty``. Only meaningful
+inside this repository, which is why it lives apart from the generic
+scaffolders.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+__all__ = [
+    "update_host_pyproject",
+    "update_release_matrix",
+    "update_root_pyproject",
+    "wire_module",
+]
+
+
+def _insert_after_last_match(content: str, pattern: str, line_to_insert: str) -> str | None:
+    """Insert ``line_to_insert`` on a new line after the last line matching ``pattern``.
+
+    Returns the modified content, or None if no line matched.
+    """
+    matches = list(re.finditer(pattern, content, re.MULTILINE))
+    if not matches:
+        return None
+    end_of_line = content.find("\n", matches[-1].end())
+    if end_of_line == -1:
+        end_of_line = len(content)
+    return content[: end_of_line + 1] + line_to_insert + content[end_of_line + 1 :]
+
+
+def update_host_pyproject(root: Path, name: str) -> None:
+    """Add the module as a dependency (and workspace source) of ``host/pyproject.toml``."""
+    host_toml = root / "host" / "pyproject.toml"
+    content = host_toml.read_text()
+    # Must be the distribution name the module's own pyproject.toml declares;
+    # the bare module name is not a workspace member and `uv sync` rejects it.
+    pkg = f"simple_module_{name}"
+
+    if f'"{pkg}"' in content:
+        print(f"  host/pyproject.toml already contains {pkg}, skipping")
+        return
+
+    original = content
+    content = _insert_after_last_match(content, r'^    "[\w-]+",\s*$', f'    "{pkg}",\n') or content
+    content = (
+        _insert_after_last_match(
+            content,
+            r"^[\w-]+ = \{ workspace = true \}\s*$",
+            f"{pkg} = {{ workspace = true }}\n",
+        )
+        or content
+    )
+    if content == original:
+        print(f"  warning: no insertion point in host/pyproject.toml for {pkg}", file=sys.stderr)
+        return
+    host_toml.write_text(content)
+    print(f"  updated host/pyproject.toml (added {pkg})")
+
+
+def update_root_pyproject(root: Path, name: str) -> None:
+    """Add the module to ``ty`` extra-paths and pytest ``testpaths`` in the root pyproject."""
+    root_toml = root / "pyproject.toml"
+    content = root_toml.read_text()
+    src_path = f"modules/{name}"
+    test_path = f"modules/{name}/tests"
+
+    if f'"{src_path}",' in content and f'"{test_path}"' in content:
+        print(f"  root pyproject.toml already contains modules/{name}, skipping")
+        return
+
+    original = content
+    content = (
+        _insert_after_last_match(content, r'^    "modules/[\w/]+",\s*$', f'    "{src_path}",\n')
+        or content
+    )
+    testpaths = list(re.finditer(r'"modules/[\w/]+/tests"', content))
+    if testpaths and f'"{test_path}"' not in content:
+        last = testpaths[-1]
+        content = content[: last.end()] + f', "{test_path}"' + content[last.end() :]
+
+    if content == original:
+        print("  warning: no insertion point in pyproject.toml", file=sys.stderr)
+        return
+    root_toml.write_text(content)
+    print("  updated pyproject.toml (added type-check path + test path)")
+
+
+def update_release_matrix(root: Path, name: str) -> None:
+    """Add the module's distribution to the ``publish-pypi`` matrix in ``release.yml``.
+
+    ``scripts/check_metadata.py`` fails until it is listed: an unlisted workspace
+    package would build on release and never reach PyPI.
+    """
+    release = root / ".github" / "workflows" / "release.yml"
+    if not release.is_file():
+        print("  warning: .github/workflows/release.yml not found", file=sys.stderr)
+        return
+    pkg = f"simple_module_{name}"
+    content = release.read_text()
+    if f"- {pkg}\n" in content:
+        print(f"  release.yml already lists {pkg}, skipping")
+        return
+    head, sep, rest = content.partition("publish-pypi:")
+    # The matrix list ends where the job's ``environment:`` key starts.
+    matrix, env_sep, after = rest.partition("    environment:")
+    updated = _insert_after_last_match(
+        matrix, r"^          - simple_module_\w+\s*$", f"          - {pkg}\n"
+    )
+    if not sep or not env_sep or updated is None:
+        print("  warning: no publish-pypi matrix in release.yml", file=sys.stderr)
+        return
+    release.write_text(head + sep + updated + env_sep + after)
+    print(f"  updated release.yml (added {pkg} to publish-pypi)")
+
+
+def wire_module(root: Path, name: str) -> None:
+    update_host_pyproject(root, name)
+    update_root_pyproject(root, name)
+    update_release_matrix(root, name)
diff --git a/framework/cli/simple_module_cli/scaffolding.py b/framework/cli/simple_module_cli/scaffolding.py
index a507b6441..f9fa8b5e0 100644
--- a/framework/cli/simple_module_cli/scaffolding.py
+++ b/framework/cli/simple_module_cli/scaffolding.py
@@ -32,6 +32,7 @@
 from simple_module_cli.case import (
     to_kebab_case,
     to_pascal_case,
+    to_singular,
     to_snake_case,
     validate_scaffold_name,
 )
@@ -189,6 +190,7 @@ def create_module(
     *,
     framework_version: str | None = None,
     standalone: bool = True,
+    framework_repo: bool = False,
 ) -> Path:
     """Scaffold a module package at ``dest``.
 
@@ -204,6 +206,14 @@ def create_module(
     is a footgun there, so callers creating an *in-repo* module pass
     ``standalone=False``. See GH #210.
 
+    ``framework_repo=True`` is the variant for a module that lives in the
+    simple_module_python monorepo itself (``make new-module``): it overlays
+    ``_optional/framework_repo/`` (a workspace-sourced ``pyproject.toml`` with
+    the metadata ``scripts/check_metadata.py`` requires, a LICENSE and README
+    that pass ``check_readmes.py``, and i18n-keyed pages) and implies no
+    ``.github/``. Wiring into the repo's own pyproject files is
+    :mod:`simple_module_cli.framework_repo`'s job.
+
     ``standalone=True`` additionally overlays ``_optional/standalone/`` (npm
     devDependencies + a tsconfig that resolves ``@simple-module-py/ui`` from the
     repo's own ``node_modules``) so the module type-checks outside a workspace.
@@ -214,11 +224,18 @@ def create_module(
     display_name = to_pascal_case(name)
     slug = to_kebab_case(name)
     package_name = to_snake_case(name)
+    singular = to_singular(package_name)
+    if framework_repo:
+        standalone = False
     substitutions = {
         "{{MODULE_NAME}}": display_name,
         "{{MODULE_SLUG}}": slug,
         "{{PACKAGE_NAME}}": package_name,
         "{{PACKAGE_NAME_UPPER}}": package_name.upper(),
+        # The sample CRUD entity the module ships ("orders" -> Order).
+        "{{SINGULAR}}": singular,
+        "{{SINGULAR_UPPER}}": singular.upper(),
+        "{{SINGULAR_CLASS}}": to_pascal_case(singular),
         # npm-side pin for @simple-module-py/* devDependencies; "*" when the
         # caller skips pinning (mirrors _should_pin_framework_version).
         "{{FRAMEWORK_VERSION}}": (
@@ -247,6 +264,13 @@ def create_module(
             )
         else:
             shutil.rmtree(dest / ".github", ignore_errors=True)
+        if framework_repo:
+            _apply_template_files(
+                base_root / "_optional" / "framework_repo",
+                dest,
+                substitutions=substitutions,
+                path_rewrites={_PACKAGE_PATH_TOKEN: package_name},
+            )
         if _should_pin_framework_version(framework_version):
             pin_framework_deps(dest / "pyproject.toml", framework_version)
     except Exception:
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/constants.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/constants.py.tpl
new file mode 100644
index 000000000..2089328c5
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/constants.py.tpl
@@ -0,0 +1,36 @@
+"""Stable identifiers for the {{MODULE_NAME}} module.
+
+Permissions, Inertia page keys, menu and routing values live here so the
+hardcoded-strings check can hold every other file to named constants.
+"""
+
+LOCALE_NAMESPACE = "{{PACKAGE_NAME}}"
+
+PERM_{{PACKAGE_NAME_UPPER}}_VIEW = "{{PACKAGE_NAME}}.view"
+PERM_{{PACKAGE_NAME_UPPER}}_CREATE = "{{PACKAGE_NAME}}.create"
+PERM_{{PACKAGE_NAME_UPPER}}_EDIT = "{{PACKAGE_NAME}}.edit"
+PERM_{{PACKAGE_NAME_UPPER}}_DELETE = "{{PACKAGE_NAME}}.delete"
+PERM_GROUP = "{{MODULE_NAME}}"
+
+PAGE_BROWSE = "{{MODULE_NAME}}/Browse"
+PAGE_CREATE = "{{MODULE_NAME}}/Create"
+PAGE_EDIT = "{{MODULE_NAME}}/Edit"
+
+API_PREFIX = "/api/{{MODULE_SLUG}}"
+VIEW_PREFIX = "/{{MODULE_SLUG}}"
+
+MENU_LABEL = "{{MODULE_NAME}}"
+MENU_LABEL_KEY = "{{PACKAGE_NAME}}.nav.title"
+# Trailing slash: the browse route is registered at "/" under the view
+# prefix, so linking to the bare prefix costs a 307 on every navigation.
+MENU_URL = "/{{MODULE_SLUG}}/"
+MENU_ICON = "box"
+MENU_ORDER = 50
+
+# All modules share one schema, so the table name carries the module prefix.
+TABLE_{{SINGULAR_UPPER}} = "{{PACKAGE_NAME}}_{{SINGULAR}}"
+
+NAME_MAX_LENGTH = 200
+DESCRIPTION_MAX_LENGTH = 2000
+
+NOT_FOUND_DETAIL = "{{SINGULAR_CLASS}} not found"
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/__init__.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/__init__.py.tpl
new file mode 100644
index 000000000..d912016ab
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/__init__.py.tpl
@@ -0,0 +1,13 @@
+"""{{MODULE_NAME}} contracts — public interface for other modules."""
+
+from {{PACKAGE_NAME}}.contracts.schemas import (
+    {{SINGULAR_CLASS}}Create,
+    {{SINGULAR_CLASS}}Out,
+    {{SINGULAR_CLASS}}Update,
+)
+
+__all__ = [
+    "{{SINGULAR_CLASS}}Create",
+    "{{SINGULAR_CLASS}}Out",
+    "{{SINGULAR_CLASS}}Update",
+]
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/schemas.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/schemas.py.tpl
new file mode 100644
index 000000000..6c4293efb
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/contracts/schemas.py.tpl
@@ -0,0 +1,46 @@
+"""SQLModel DTOs for the {{MODULE_NAME}} module."""
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import ConfigDict, field_validator
+from sqlmodel import Field, SQLModel
+
+from {{PACKAGE_NAME}}.constants import DESCRIPTION_MAX_LENGTH, NAME_MAX_LENGTH
+
+
+class {{SINGULAR_CLASS}}Out(SQLModel):
+    """{{SINGULAR_CLASS}} data returned by the API."""
+
+    model_config = ConfigDict(from_attributes=True)  # ty: ignore[invalid-assignment]
+
+    id: int
+    name: str
+    description: str | None = None
+    is_active: bool
+    created_at: datetime | None = None
+    updated_at: datetime | None = None
+
+
+class {{SINGULAR_CLASS}}Create(SQLModel):
+    """Data required to create a new {{SINGULAR}}."""
+
+    name: str = Field(min_length=1, max_length=NAME_MAX_LENGTH)
+    description: str | None = Field(default=None, max_length=DESCRIPTION_MAX_LENGTH)
+
+
+class {{SINGULAR_CLASS}}Update(SQLModel):
+    """Data to update an existing {{SINGULAR}}. All fields optional."""
+
+    name: str | None = Field(default=None, min_length=1, max_length=NAME_MAX_LENGTH)
+    description: str | None = Field(default=None, max_length=DESCRIPTION_MAX_LENGTH)
+    is_active: bool | None = None
+
+    @field_validator("name", "is_active", mode="before")
+    @classmethod
+    def _reject_explicit_null(cls, value: object) -> object:
+        """Omitted means unchanged; an explicit null would hit a NOT NULL column."""
+        if value is None:
+            raise ValueError("must not be null")
+        return value
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/deps.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/deps.py.tpl
new file mode 100644
index 000000000..544195672
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/deps.py.tpl
@@ -0,0 +1,15 @@
+"""FastAPI dependencies for the {{MODULE_NAME}} module."""
+
+from __future__ import annotations
+
+from fastapi import Depends
+from simple_module_db.deps import get_db
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from {{PACKAGE_NAME}}.service import {{SINGULAR_CLASS}}Service
+
+
+async def get_{{SINGULAR}}_service(
+    db: AsyncSession = Depends(get_db),
+) -> {{SINGULAR_CLASS}}Service:
+    return {{SINGULAR_CLASS}}Service(db)
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/api.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/api.py.tpl
index 13ed76fa0..f2fbffc9e 100644
--- a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/api.py.tpl
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/api.py.tpl
@@ -1,11 +1,91 @@
-"""API routes for the {{MODULE_NAME}} module."""
+"""REST API endpoints for {{MODULE_NAME}} — mounted under ``/api/{{MODULE_SLUG}}``."""
 
-from fastapi import APIRouter
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException
+from simple_module_hosting.permissions import RequiresPermission
+
+from {{PACKAGE_NAME}}.constants import (
+    NOT_FOUND_DETAIL,
+    PERM_{{PACKAGE_NAME_UPPER}}_CREATE,
+    PERM_{{PACKAGE_NAME_UPPER}}_DELETE,
+    PERM_{{PACKAGE_NAME_UPPER}}_EDIT,
+    PERM_{{PACKAGE_NAME_UPPER}}_VIEW,
+)
+from {{PACKAGE_NAME}}.contracts.schemas import (
+    {{SINGULAR_CLASS}}Create,
+    {{SINGULAR_CLASS}}Out,
+    {{SINGULAR_CLASS}}Update,
+)
+from {{PACKAGE_NAME}}.deps import get_{{SINGULAR}}_service
+from {{PACKAGE_NAME}}.service import {{SINGULAR_CLASS}}Service
 
 router = APIRouter()
 
 
-@router.get("/")
-async def list_items() -> dict:
-    """Placeholder endpoint. Replace with real resources."""
-    return {"module": "{{MODULE_NAME}}", "items": []}
+@router.get(
+    "/",
+    response_model=list[{{SINGULAR_CLASS}}Out],
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_VIEW))],
+)
+async def list_items(
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> list[{{SINGULAR_CLASS}}Out]:
+    return await service.get_all()
+
+
+@router.get(
+    "/{item_id}",
+    response_model={{SINGULAR_CLASS}}Out,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_VIEW))],
+)
+async def get_item(
+    item_id: int,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> {{SINGULAR_CLASS}}Out:
+    result = await service.get_by_id(item_id)
+    if result is None:
+        raise HTTPException(status_code=404, detail=NOT_FOUND_DETAIL)
+    return result
+
+
+@router.post(
+    "/",
+    response_model={{SINGULAR_CLASS}}Out,
+    status_code=201,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_CREATE))],
+)
+async def create_item(
+    data: {{SINGULAR_CLASS}}Create,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> {{SINGULAR_CLASS}}Out:
+    return await service.create(data)
+
+
+@router.put(
+    "/{item_id}",
+    response_model={{SINGULAR_CLASS}}Out,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_EDIT))],
+)
+async def update_item(
+    item_id: int,
+    data: {{SINGULAR_CLASS}}Update,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> {{SINGULAR_CLASS}}Out:
+    result = await service.update(item_id, data)
+    if result is None:
+        raise HTTPException(status_code=404, detail=NOT_FOUND_DETAIL)
+    return result
+
+
+@router.delete(
+    "/{item_id}",
+    status_code=204,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_DELETE))],
+)
+async def delete_item(
+    item_id: int,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> None:
+    if not await service.delete(item_id):
+        raise HTTPException(status_code=404, detail=NOT_FOUND_DETAIL)
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/views.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/views.py.tpl
index a97f00c0c..593683751 100644
--- a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/views.py.tpl
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/endpoints/views.py.tpl
@@ -2,15 +2,94 @@
 
 from __future__ import annotations
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
+from starlette.responses import RedirectResponse
+
+from {{PACKAGE_NAME}}.constants import (
+    MENU_URL,
+    PAGE_BROWSE,
+    PAGE_CREATE,
+    PAGE_EDIT,
+    PERM_{{PACKAGE_NAME_UPPER}}_CREATE,
+    PERM_{{PACKAGE_NAME_UPPER}}_EDIT,
+    PERM_{{PACKAGE_NAME_UPPER}}_VIEW,
+)
+from {{PACKAGE_NAME}}.contracts.schemas import (
+    {{SINGULAR_CLASS}}Create,
+    {{SINGULAR_CLASS}}Update,
+)
+from {{PACKAGE_NAME}}.deps import get_{{SINGULAR}}_service
+from {{PACKAGE_NAME}}.service import {{SINGULAR_CLASS}}Service
 
 router = APIRouter()
 
-_PAGE_INDEX = "{{MODULE_NAME}}/Index"
+
+@router.get(
+    "/",
+    response_model=None,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_VIEW))],
+)
+async def browse(
+    inertia: InertiaDep,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> InertiaResponse:
+    items = await service.get_all()
+    return await inertia.render(
+        PAGE_BROWSE,
+        {"items": [item.model_dump(mode="json") for item in items]},
+    )
+
+
+@router.get(
+    "/create",
+    response_model=None,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_CREATE))],
+)
+async def create_view(inertia: InertiaDep) -> InertiaResponse:
+    return await inertia.render(PAGE_CREATE)
+
+
+@router.post(
+    "/",
+    response_model=None,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_CREATE))],
+)
+async def create_submit(
+    data: {{SINGULAR_CLASS}}Create,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> RedirectResponse:
+    await service.create(data)
+    return RedirectResponse(MENU_URL, status_code=303)
+
+
+@router.get(
+    "/{item_id}/edit",
+    response_model=None,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_EDIT))],
+)
+async def edit_view(
+    item_id: int,
+    inertia: InertiaDep,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> InertiaResponse | RedirectResponse:
+    item = await service.get_by_id(item_id)
+    if item is None:
+        return RedirectResponse(MENU_URL, status_code=303)
+    return await inertia.render(PAGE_EDIT, {"item": item.model_dump(mode="json")})
 
 
-@router.get("/", response_model=None)
-async def index(inertia: InertiaDep) -> InertiaResponse:
-    return await inertia.render(_PAGE_INDEX, {})
+@router.post(
+    "/{item_id}",
+    response_model=None,
+    dependencies=[Depends(RequiresPermission(PERM_{{PACKAGE_NAME_UPPER}}_EDIT))],
+)
+async def edit_submit(
+    item_id: int,
+    data: {{SINGULAR_CLASS}}Update,
+    service: {{SINGULAR_CLASS}}Service = Depends(get_{{SINGULAR}}_service),
+) -> RedirectResponse:
+    await service.update(item_id, data)
+    return RedirectResponse(MENU_URL, status_code=303)
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/locales/en.json.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/locales/en.json.tpl
new file mode 100644
index 000000000..053ebafe7
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/locales/en.json.tpl
@@ -0,0 +1,25 @@
+{
+  "nav": {
+    "title": "{{MODULE_NAME}}"
+  },
+  "browse": {
+    "title": "{{MODULE_NAME}}",
+    "description": "Manage your {{PACKAGE_NAME}}",
+    "new_button": "New {{SINGULAR_CLASS}}",
+    "empty_title": "No {{PACKAGE_NAME}} yet",
+    "empty_description": "Get started by creating your first {{SINGULAR}}.",
+    "edit_link": "Edit"
+  },
+  "form": {
+    "name_label": "Name",
+    "description_label": "Description"
+  },
+  "create": {
+    "title": "New {{SINGULAR_CLASS}}",
+    "submit_button": "Create"
+  },
+  "edit": {
+    "title": "Edit {{SINGULAR_CLASS}}",
+    "submit_button": "Save"
+  }
+}
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/models.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/models.py.tpl
new file mode 100644
index 000000000..15d396017
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/models.py.tpl
@@ -0,0 +1,26 @@
+"""SQLModel tables for the {{MODULE_NAME}} module."""
+
+from __future__ import annotations
+
+from simple_module_db.base import create_module_base
+from simple_module_db.mixins import AuditMixin
+from sqlmodel import Field
+
+from {{PACKAGE_NAME}}.constants import (
+    DESCRIPTION_MAX_LENGTH,
+    NAME_MAX_LENGTH,
+    TABLE_{{SINGULAR_UPPER}},
+)
+
+Base = create_module_base("{{PACKAGE_NAME}}")
+
+
+class {{SINGULAR_CLASS}}(Base, AuditMixin, table=True):  # ty: ignore[unsupported-base]
+    """A {{SINGULAR}} entity."""
+
+    __tablename__ = TABLE_{{SINGULAR_UPPER}}
+
+    id: int | None = Field(default=None, primary_key=True)
+    name: str = Field(max_length=NAME_MAX_LENGTH)
+    description: str | None = Field(default=None, max_length=DESCRIPTION_MAX_LENGTH)
+    is_active: bool = Field(default=True)
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/module.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/module.py.tpl
index f2c68b46c..1b78320de 100644
--- a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/module.py.tpl
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/module.py.tpl
@@ -9,18 +9,48 @@ from fastapi import APIRouter, FastAPI
 from simple_module_core import ModuleBase, ModuleMeta
 from simple_module_core.menu import MenuItem, MenuRegistry, MenuSection
 from simple_module_core.module_settings import register_module_settings
+from simple_module_core.permissions import PermissionRegistry
+
+from {{PACKAGE_NAME}}.constants import (
+    API_PREFIX,
+    LOCALE_NAMESPACE,
+    MENU_ICON,
+    MENU_LABEL,
+    MENU_LABEL_KEY,
+    MENU_ORDER,
+    MENU_URL,
+    PERM_GROUP,
+    PERM_{{PACKAGE_NAME_UPPER}}_CREATE,
+    PERM_{{PACKAGE_NAME_UPPER}}_DELETE,
+    PERM_{{PACKAGE_NAME_UPPER}}_EDIT,
+    PERM_{{PACKAGE_NAME_UPPER}}_VIEW,
+    VIEW_PREFIX,
+)
 
 
 class {{MODULE_NAME}}Module(ModuleBase):
     meta = ModuleMeta(
         name="{{MODULE_NAME}}",
-        route_prefix="/api/{{MODULE_SLUG}}",
-        view_prefix="/{{MODULE_SLUG}}",
+        route_prefix=API_PREFIX,
+        view_prefix=VIEW_PREFIX,
         depends_on=[],
         version="0.1.0",
         requires_framework=">=1.0,<2.0",
     )
 
+    def register_settings(self, app: FastAPI) -> None:
+        from {{PACKAGE_NAME}}.services import {{MODULE_NAME}}Services
+        from {{PACKAGE_NAME}}.settings import {{MODULE_NAME}}Settings
+
+        # Records the class so the host hydrates it from the settings table
+        # (DB → default) and mounts the services on app.state.{{PACKAGE_NAME}}.
+        register_module_settings(
+            app,
+            "{{PACKAGE_NAME}}",
+            {{MODULE_NAME}}Settings,
+            lambda s: {{MODULE_NAME}}Services(settings=s),
+        )
+
     def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
         from {{PACKAGE_NAME}}.endpoints.api import router as api
         from {{PACKAGE_NAME}}.endpoints.views import router as views
@@ -31,26 +61,33 @@ class {{MODULE_NAME}}Module(ModuleBase):
     def register_menu_items(self, registry: MenuRegistry) -> None:
         registry.add(
             MenuItem(
-                label="{{MODULE_NAME}}",
-                url="/{{MODULE_SLUG}}",
-                order=50,
+                label=MENU_LABEL,
+                label_key=MENU_LABEL_KEY,
+                url=MENU_URL,
+                icon=MENU_ICON,
+                order=MENU_ORDER,
                 section=MenuSection.SIDEBAR,
+                # Mirrors the view router's guard, so the entry never shows
+                # for an account that would 403 on click.
+                permissions=[PERM_{{PACKAGE_NAME_UPPER}}_VIEW],
             )
         )
 
-    def register_settings(self, app: FastAPI) -> None:
-        from {{PACKAGE_NAME}}.services import {{MODULE_NAME}}Services
-        from {{PACKAGE_NAME}}.settings import {{MODULE_NAME}}Settings
-
-        # Records the class so the host hydrates it from the settings table
-        # (DB → default) and mounts the services on app.state.{{PACKAGE_NAME}}.
-        register_module_settings(
-            app,
-            "{{PACKAGE_NAME}}",
-            {{MODULE_NAME}}Settings,
-            lambda s: {{MODULE_NAME}}Services(settings=s),
+    def register_permissions(self, registry: PermissionRegistry) -> None:
+        registry.add_group(
+            PERM_GROUP,
+            [
+                PERM_{{PACKAGE_NAME_UPPER}}_VIEW,
+                PERM_{{PACKAGE_NAME_UPPER}}_CREATE,
+                PERM_{{PACKAGE_NAME_UPPER}}_EDIT,
+                PERM_{{PACKAGE_NAME_UPPER}}_DELETE,
+            ],
         )
 
+    def locale_dirs(self) -> dict[str, Path]:
+        base = Path(str(importlib.resources.files(__package__) / "locales"))
+        return {LOCALE_NAMESPACE: base}
+
     def static_mounts(self) -> dict[str, Path]:
         """Expose pre-built frontend assets when they exist.
 
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Browse.tsx.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Browse.tsx.tpl
new file mode 100644
index 000000000..91f0063ac
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Browse.tsx.tpl
@@ -0,0 +1,37 @@
+import { Head, Link } from '@inertiajs/react';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+type Item = {
+  id: number;
+  name: string;
+  description: string | null;
+  is_active: boolean;
+};
+
+export default function Browse({ items }: { items: Item[] }) {
+  return (
+    <PageShell title="{{MODULE_NAME}}" description="Manage your {{PACKAGE_NAME}}">
+      <Head title="{{MODULE_NAME}}" />
+      <div className="mb-4 flex justify-end">
+        <Link
+          href="/{{MODULE_SLUG}}/create"
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          New {{SINGULAR_CLASS}}
+        </Link>
+      </div>
+      {items.length === 0 ? (
+        <p className="py-12 text-center text-sm text-muted-foreground">No {{PACKAGE_NAME}} yet.</p>
+      ) : (
+        <ul className="divide-y">
+          {items.map((item) => (
+            <li key={item.id} className="flex justify-between py-2">
+              <span>{item.name}</span>
+              <Link href={`/{{MODULE_SLUG}}/${item.id}/edit`}>Edit</Link>
+            </li>
+          ))}
+        </ul>
+      )}
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Create.tsx.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Create.tsx.tpl
new file mode 100644
index 000000000..0c37444a8
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Create.tsx.tpl
@@ -0,0 +1,43 @@
+import { Head, useForm } from '@inertiajs/react';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+export default function Create() {
+  const form = useForm({ name: '', description: '' });
+  return (
+    <PageShell title="New {{SINGULAR_CLASS}}">
+      <Head title="New {{SINGULAR_CLASS}}" />
+      <form
+        className="max-w-xl space-y-3"
+        onSubmit={(e) => {
+          e.preventDefault();
+          form.post('/{{MODULE_SLUG}}/');
+        }}
+      >
+        <label className="block">
+          <span className="block text-sm">Name</span>
+          <input
+            required
+            value={form.data.name}
+            onChange={(e) => form.setData('name', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <label className="block">
+          <span className="block text-sm">Description</span>
+          <textarea
+            value={form.data.description}
+            onChange={(e) => form.setData('description', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <button
+          type="submit"
+          disabled={form.processing}
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          Create
+        </button>
+      </form>
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Edit.tsx.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Edit.tsx.tpl
new file mode 100644
index 000000000..d87b34478
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Edit.tsx.tpl
@@ -0,0 +1,50 @@
+import { Head, useForm } from '@inertiajs/react';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+type Item = {
+  id: number;
+  name: string;
+  description: string | null;
+  is_active: boolean;
+};
+
+export default function Edit({ item }: { item: Item }) {
+  const form = useForm({ name: item.name, description: item.description ?? '' });
+  return (
+    <PageShell title="Edit {{SINGULAR_CLASS}}">
+      <Head title="Edit {{SINGULAR_CLASS}}" />
+      <form
+        className="max-w-xl space-y-3"
+        onSubmit={(e) => {
+          e.preventDefault();
+          form.post(`/{{MODULE_SLUG}}/${item.id}`);
+        }}
+      >
+        <label className="block">
+          <span className="block text-sm">Name</span>
+          <input
+            required
+            value={form.data.name}
+            onChange={(e) => form.setData('name', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <label className="block">
+          <span className="block text-sm">Description</span>
+          <textarea
+            value={form.data.description}
+            onChange={(e) => form.setData('description', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <button
+          type="submit"
+          disabled={form.processing}
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          Save
+        </button>
+      </form>
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Index.tsx.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Index.tsx.tpl
deleted file mode 100644
index 86cfc2ac6..000000000
--- a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/pages/Index.tsx.tpl
+++ /dev/null
@@ -1,13 +0,0 @@
-import { Head } from '@inertiajs/react';
-import { PageShell } from '@simple-module-py/ui/components/PageShell';
-
-export default function Index() {
-  return (
-    <PageShell title="{{MODULE_NAME}}" description="Scaffolded by smpy create-module — replace this page.">
-      <Head title="{{MODULE_NAME}}" />
-      <p className="text-sm text-muted-foreground">
-        Edit <code>pages/Index.tsx</code> to build the {{MODULE_NAME}} UI.
-      </p>
-    </PageShell>
-  );
-}
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/py.typed b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/py.typed
new file mode 100644
index 000000000..e69de29bb
diff --git a/framework/cli/simple_module_cli/templates/module/__PACKAGE__/service.py.tpl b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/service.py.tpl
new file mode 100644
index 000000000..3acf774d9
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/__PACKAGE__/service.py.tpl
@@ -0,0 +1,60 @@
+"""{{SINGULAR_CLASS}} service implementation."""
+
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlmodel import col
+
+from {{PACKAGE_NAME}}.contracts.schemas import (
+    {{SINGULAR_CLASS}}Create,
+    {{SINGULAR_CLASS}}Out,
+    {{SINGULAR_CLASS}}Update,
+)
+from {{PACKAGE_NAME}}.models import {{SINGULAR_CLASS}}
+
+
+class {{SINGULAR_CLASS}}Service:
+    """CRUD operations for {{PACKAGE_NAME}}."""
+
+    def __init__(self, db: AsyncSession) -> None:
+        self.db = db
+
+    async def get_all(self) -> list[{{SINGULAR_CLASS}}Out]:
+        model = {{SINGULAR_CLASS}}
+        result = await self.db.execute(select(model).order_by(col(model.id)))
+        return [{{SINGULAR_CLASS}}Out.model_validate(row) for row in result.scalars()]
+
+    async def get_by_id(self, item_id: int) -> {{SINGULAR_CLASS}}Out | None:
+        entity = await self.db.get({{SINGULAR_CLASS}}, item_id)
+        if entity is None:
+            return None
+        return {{SINGULAR_CLASS}}Out.model_validate(entity)
+
+    async def create(self, data: {{SINGULAR_CLASS}}Create) -> {{SINGULAR_CLASS}}Out:
+        entity = {{SINGULAR_CLASS}}(**data.model_dump())
+        self.db.add(entity)
+        await self.db.flush()
+        await self.db.refresh(entity)
+        return {{SINGULAR_CLASS}}Out.model_validate(entity)
+
+    async def update(
+        self,
+        item_id: int,
+        data: {{SINGULAR_CLASS}}Update,
+    ) -> {{SINGULAR_CLASS}}Out | None:
+        entity = await self.db.get({{SINGULAR_CLASS}}, item_id)
+        if entity is None:
+            return None
+        for field, value in data.model_dump(exclude_unset=True).items():
+            setattr(entity, field, value)
+        await self.db.flush()
+        await self.db.refresh(entity)
+        return {{SINGULAR_CLASS}}Out.model_validate(entity)
+
+    async def delete(self, item_id: int) -> bool:
+        entity = await self.db.get({{SINGULAR_CLASS}}, item_id)
+        if entity is None:
+            return False
+        await self.db.delete(entity)
+        return True
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/LICENSE b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/LICENSE
new file mode 100644
index 000000000..a1e1d361f
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anto Subash
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/README.md.tpl b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/README.md.tpl
new file mode 100644
index 000000000..b42ee79ba
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/README.md.tpl
@@ -0,0 +1,34 @@
+# simple_module_{{PACKAGE_NAME}}
+
+The {{MODULE_NAME}} module for
+[simple_module](https://github.com/antosubash/simple_module_python) apps.
+
+Replace this paragraph with a description of what the module actually does —
+the problem it solves and the surface it exposes to a host application.
+
+## Install
+
+```bash
+pip install simple_module_{{PACKAGE_NAME}}
+```
+
+Add `simple_module_{{PACKAGE_NAME}}` to your host's dependencies; the
+`[project.entry-points.simple_module]` entry point is discovered automatically
+at boot, so no further wiring is required.
+
+## Usage
+
+| Route | Page | Permission |
+|---|---|---|
+| `GET /{{MODULE_SLUG}}/` | `{{MODULE_NAME}}/Browse` | `{{PACKAGE_NAME}}.view` |
+| `GET /{{MODULE_SLUG}}/create` | `{{MODULE_NAME}}/Create` | `{{PACKAGE_NAME}}.create` |
+| `GET /{{MODULE_SLUG}}/{id}/edit` | `{{MODULE_NAME}}/Edit` | `{{PACKAGE_NAME}}.edit` |
+| `/api/{{MODULE_SLUG}}/` | — | JSON CRUD, gated per verb |
+
+Document the real routes, settings and any events the module emits here.
+
+## Configuration
+
+Settings are a `DbBackedSettings` subclass (`{{PACKAGE_NAME}}/settings.py`) read
+from the settings table and exposed on `app.state.{{PACKAGE_NAME}}`; nothing is
+read from environment variables.
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Browse.tsx.tpl b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Browse.tsx.tpl
new file mode 100644
index 000000000..243dd9799
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Browse.tsx.tpl
@@ -0,0 +1,48 @@
+import { Head, Link } from '@inertiajs/react';
+import { keys, useT } from '@simple-module-py/i18n';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+type Item = {
+  id: number;
+  name: string;
+  description: string | null;
+  is_active: boolean;
+};
+
+export default function Browse({ items }: { items: Item[] }) {
+  const { t } = useT();
+  const editLabel = t(keys.{{PACKAGE_NAME}}.browse.edit_link);
+  return (
+    <PageShell
+      title={t(keys.{{PACKAGE_NAME}}.browse.title)}
+      description={t(keys.{{PACKAGE_NAME}}.browse.description)}
+    >
+      <Head title={t(keys.{{PACKAGE_NAME}}.browse.title)} />
+      <div className="mb-4 flex justify-end">
+        <Link
+          href="/{{MODULE_SLUG}}/create"
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          {t(keys.{{PACKAGE_NAME}}.browse.new_button)}
+        </Link>
+      </div>
+      {items.length === 0 ? (
+        <div className="py-12 text-center">
+          <h2 className="text-lg font-medium">{t(keys.{{PACKAGE_NAME}}.browse.empty_title)}</h2>
+          <p className="mt-1 text-sm text-muted-foreground">
+            {t(keys.{{PACKAGE_NAME}}.browse.empty_description)}
+          </p>
+        </div>
+      ) : (
+        <ul className="divide-y">
+          {items.map((item) => (
+            <li key={item.id} className="flex justify-between py-2">
+              <span>{item.name}</span>
+              <Link href={`/{{MODULE_SLUG}}/${item.id}/edit`}>{editLabel}</Link>
+            </li>
+          ))}
+        </ul>
+      )}
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Create.tsx.tpl b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Create.tsx.tpl
new file mode 100644
index 000000000..4e9f7d1e7
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Create.tsx.tpl
@@ -0,0 +1,45 @@
+import { Head, useForm } from '@inertiajs/react';
+import { keys, useT } from '@simple-module-py/i18n';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+export default function Create() {
+  const { t } = useT();
+  const form = useForm({ name: '', description: '' });
+  return (
+    <PageShell title={t(keys.{{PACKAGE_NAME}}.create.title)}>
+      <Head title={t(keys.{{PACKAGE_NAME}}.create.title)} />
+      <form
+        className="max-w-xl space-y-3"
+        onSubmit={(e) => {
+          e.preventDefault();
+          form.post('/{{MODULE_SLUG}}/');
+        }}
+      >
+        <label className="block">
+          <span className="block text-sm">{t(keys.{{PACKAGE_NAME}}.form.name_label)}</span>
+          <input
+            required
+            value={form.data.name}
+            onChange={(e) => form.setData('name', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <label className="block">
+          <span className="block text-sm">{t(keys.{{PACKAGE_NAME}}.form.description_label)}</span>
+          <textarea
+            value={form.data.description}
+            onChange={(e) => form.setData('description', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <button
+          type="submit"
+          disabled={form.processing}
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          {t(keys.{{PACKAGE_NAME}}.create.submit_button)}
+        </button>
+      </form>
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Edit.tsx.tpl b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Edit.tsx.tpl
new file mode 100644
index 000000000..b6601e989
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/__PACKAGE__/pages/Edit.tsx.tpl
@@ -0,0 +1,52 @@
+import { Head, useForm } from '@inertiajs/react';
+import { keys, useT } from '@simple-module-py/i18n';
+import { PageShell } from '@simple-module-py/ui/components/PageShell';
+
+type Item = {
+  id: number;
+  name: string;
+  description: string | null;
+  is_active: boolean;
+};
+
+export default function Edit({ item }: { item: Item }) {
+  const { t } = useT();
+  const form = useForm({ name: item.name, description: item.description ?? '' });
+  return (
+    <PageShell title={t(keys.{{PACKAGE_NAME}}.edit.title)}>
+      <Head title={t(keys.{{PACKAGE_NAME}}.edit.title)} />
+      <form
+        className="max-w-xl space-y-3"
+        onSubmit={(e) => {
+          e.preventDefault();
+          form.post(`/{{MODULE_SLUG}}/${item.id}`);
+        }}
+      >
+        <label className="block">
+          <span className="block text-sm">{t(keys.{{PACKAGE_NAME}}.form.name_label)}</span>
+          <input
+            required
+            value={form.data.name}
+            onChange={(e) => form.setData('name', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <label className="block">
+          <span className="block text-sm">{t(keys.{{PACKAGE_NAME}}.form.description_label)}</span>
+          <textarea
+            value={form.data.description}
+            onChange={(e) => form.setData('description', e.target.value)}
+            className="w-full rounded border p-2"
+          />
+        </label>
+        <button
+          type="submit"
+          disabled={form.processing}
+          className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
+        >
+          {t(keys.{{PACKAGE_NAME}}.edit.submit_button)}
+        </button>
+      </form>
+    </PageShell>
+  );
+}
diff --git a/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/pyproject.toml.tpl b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/pyproject.toml.tpl
new file mode 100644
index 000000000..60e8f1ed9
--- /dev/null
+++ b/framework/cli/simple_module_cli/templates/module/_optional/framework_repo/pyproject.toml.tpl
@@ -0,0 +1,44 @@
+[project]
+name = "simple_module_{{PACKAGE_NAME}}"
+version = "0.1.0"
+description = "The {{MODULE_NAME}} module"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+authors = [{ name = "Anto Subash", email = "antosubash@live.com" }]
+keywords = ["simple-module", "{{PACKAGE_NAME}}"]
+dependencies = [
+    "simple_module_core",
+    "simple_module_db",
+    "simple_module_hosting",
+]
+
+[project.entry-points.simple_module]
+{{PACKAGE_NAME}} = "{{PACKAGE_NAME}}.module:{{MODULE_NAME}}Module"
+
+[project.urls]
+Homepage = "https://github.com/antosubash/simple_module_python"
+Repository = "https://github.com/antosubash/simple_module_python"
+Issues = "https://github.com/antosubash/simple_module_python/issues"
+Changelog = "https://github.com/antosubash/simple_module_python/blob/main/CHANGELOG.md"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+# The distribution name (simple_module_{{PACKAGE_NAME}}) doesn't match the package
+# directory ({{PACKAGE_NAME}}), so hatchling can't infer what to ship — without
+# this the wheel builds empty and the entry point fails to import.
+[tool.hatch.build.targets.wheel]
+packages = ["{{PACKAGE_NAME}}"]
+
+# Ship the module-root package.json inside the wheel so the host can
+# discover JS deps via importlib.resources after a pip install.
+[tool.hatch.build.targets.wheel.force-include]
+"package.json" = "{{PACKAGE_NAME}}/package.json"
+
+[tool.uv.sources]
+simple_module_core = { workspace = true }
+simple_module_db = { workspace = true }
+simple_module_hosting = { workspace = true }
diff --git a/framework/cli/simple_module_cli/templates/module/tests/test___PACKAGE__.py.tpl b/framework/cli/simple_module_cli/templates/module/tests/test___PACKAGE__.py.tpl
index 4d8b5d594..0b9b07730 100644
--- a/framework/cli/simple_module_cli/templates/module/tests/test___PACKAGE__.py.tpl
+++ b/framework/cli/simple_module_cli/templates/module/tests/test___PACKAGE__.py.tpl
@@ -1,14 +1,30 @@
-"""Smoke tests for the {{MODULE_NAME}} module.
+"""Tests for the {{MODULE_NAME}} module: schemas, service CRUD, API, boot.
 
-The ``build_test_app`` and ``fake_event_bus`` fixtures come from the
-``simple_module_test`` pytest plugin (registered via entry_points when
-that package is installed). No conftest.py is required.
+The ``build_test_app``, ``db_session`` and ``authenticated_client`` fixtures
+come from the ``simple_module_test`` pytest plugin (registered via
+entry_points when that package is installed). No conftest.py is required.
 """
 
+# Import order depends on whether ruff counts this module first-party, which
+# differs between an in-repo module and a standalone package; don't fight it.
+# ruff: noqa: I001
+
 from __future__ import annotations
 
-from {{PACKAGE_NAME}}.module import {{MODULE_NAME}}Module
+import httpx
+import pytest
+from pydantic import ValidationError
 from simple_module_test import effective_route_paths
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from {{PACKAGE_NAME}}.contracts.schemas import (
+    {{SINGULAR_CLASS}}Create,
+    {{SINGULAR_CLASS}}Update,
+)
+from {{PACKAGE_NAME}}.module import {{MODULE_NAME}}Module
+from {{PACKAGE_NAME}}.service import {{SINGULAR_CLASS}}Service
+
+API = "/api/{{MODULE_SLUG}}/"
 
 
 class TestMeta:
@@ -19,12 +35,92 @@ class TestMeta:
         assert {{MODULE_NAME}}Module.meta.requires_framework is not None
 
 
-class TestRoutes:
+class TestSchemas:
+    def test_create_valid(self):
+        data = {{SINGULAR_CLASS}}Create(name="Test")
+        assert data.name == "Test"
+        assert data.description is None
+
+    def test_create_empty_name_rejected(self):
+        with pytest.raises(ValidationError):
+            {{SINGULAR_CLASS}}Create(name="")
+
+    def test_update_all_optional(self):
+        data = {{SINGULAR_CLASS}}Update()
+        assert data.name is None
+        assert data.is_active is None
+
+
+class TestService:
+    async def test_create(self, db_session: AsyncSession):
+        svc = {{SINGULAR_CLASS}}Service(db_session)
+        item = await svc.create({{SINGULAR_CLASS}}Create(name="Test"))
+        assert item.id is not None
+        assert item.is_active is True
+
+    async def test_get_all(self, db_session: AsyncSession):
+        svc = {{SINGULAR_CLASS}}Service(db_session)
+        await svc.create({{SINGULAR_CLASS}}Create(name="A"))
+        await svc.create({{SINGULAR_CLASS}}Create(name="B"))
+        assert len(await svc.get_all()) == 2
+
+    async def test_get_by_id(self, db_session: AsyncSession):
+        svc = {{SINGULAR_CLASS}}Service(db_session)
+        created = await svc.create({{SINGULAR_CLASS}}Create(name="X"))
+        found = await svc.get_by_id(created.id)
+        assert found is not None
+        assert found.name == "X"
+        assert await svc.get_by_id(999) is None
+
+    async def test_update(self, db_session: AsyncSession):
+        svc = {{SINGULAR_CLASS}}Service(db_session)
+        created = await svc.create({{SINGULAR_CLASS}}Create(name="Old"))
+        updated = await svc.update(created.id, {{SINGULAR_CLASS}}Update(name="New"))
+        assert updated is not None
+        assert updated.name == "New"
+        assert await svc.update(999, {{SINGULAR_CLASS}}Update(name="Ghost")) is None
+
+    async def test_delete(self, db_session: AsyncSession):
+        svc = {{SINGULAR_CLASS}}Service(db_session)
+        created = await svc.create({{SINGULAR_CLASS}}Create(name="Doomed"))
+        assert await svc.delete(created.id) is True
+        assert await svc.delete(999) is False
+
+
+class TestAPI:
+    async def test_list_empty(self, authenticated_client: httpx.AsyncClient):
+        resp = await authenticated_client.get(API)
+        assert resp.status_code == 200
+        assert resp.json() == []
+
+    async def test_crud_roundtrip(self, authenticated_client: httpx.AsyncClient):
+        created = await authenticated_client.post(API, json={"name": "Original"})
+        assert created.status_code == 201
+        item_id = created.json()["id"]
+
+        got = await authenticated_client.get(f"{API}{item_id}")
+        assert got.json()["name"] == "Original"
+
+        updated = await authenticated_client.put(f"{API}{item_id}", json={"name": "Updated"})
+        assert updated.json()["name"] == "Updated"
+
+        assert (await authenticated_client.delete(f"{API}{item_id}")).status_code == 204
+        assert (await authenticated_client.get(f"{API}{item_id}")).status_code == 404
+
+    async def test_missing_item_is_404(self, authenticated_client: httpx.AsyncClient):
+        assert (await authenticated_client.get(f"{API}99999")).status_code == 404
+        assert (await authenticated_client.delete(f"{API}99999")).status_code == 404
+
+    async def test_create_invalid_data(self, authenticated_client: httpx.AsyncClient):
+        resp = await authenticated_client.post(API, json={"name": ""})
+        assert resp.status_code == 422
+
+
+class TestBoot:
     async def test_app_boots_with_module(self, build_test_app):
         """Module registers cleanly into a minimal FastAPI host."""
         app = build_test_app({{MODULE_NAME}}Module)
         # effective_route_paths reads the OpenAPI schema: FastAPI >= 0.137
         # includes routers lazily, so ``app.routes`` no longer lists them.
         paths = effective_route_paths(app)
-        # The placeholder GET / endpoint lives under the route_prefix.
         assert any(p.startswith("/api/{{MODULE_SLUG}}") for p in paths)
diff --git a/framework/cli/tests/test_cli_new_regressions.py b/framework/cli/tests/test_cli_new_regressions.py
index b99a94f23..2a7938152 100644
--- a/framework/cli/tests/test_cli_new_regressions.py
+++ b/framework/cli/tests/test_cli_new_regressions.py
@@ -94,7 +94,9 @@ def test_sm_new_sample_module_views_carry_a_menu_item(tmp_path: Path) -> None:
         ["new", "demo", "--yes", "--db", "sqlite", "--no-install", "--dest", str(target)],
     )
     module_py = (target / "modules" / "hello" / "hello" / "module.py").read_text()
-    assert 'view_prefix="/hello"' in module_py
+    constants = (target / "modules" / "hello" / "hello" / "constants.py").read_text()
+    assert "view_prefix=VIEW_PREFIX" in module_py
+    assert 'VIEW_PREFIX = "/hello"' in constants
     assert "register_menu_items" in module_py
 
 
diff --git a/framework/cli/tests/test_framework_repo_wiring.py b/framework/cli/tests/test_framework_repo_wiring.py
new file mode 100644
index 000000000..cf6d20805
--- /dev/null
+++ b/framework/cli/tests/test_framework_repo_wiring.py
@@ -0,0 +1,125 @@
+"""Wiring a scaffolded module into the monorepo's pyproject files, and the script wrapper."""
+
+from __future__ import annotations
+
+import importlib.util
+import sys
+from pathlib import Path
+
+import pytest
+from simple_module_cli.framework_repo import (
+    _insert_after_last_match,
+    update_host_pyproject,
+    update_release_matrix,
+    update_root_pyproject,
+)
+
+HOST = (
+    '[project]\ndependencies = [\n    "products",\n]\n\n'
+    "[tool.uv.sources]\nproducts = { workspace = true }\n"
+)
+ROOT_TOML = (
+    '[tool.ty.environment]\nextra-paths = [\n    "modules/products",\n    "host",\n]\n\n'
+    '[tool.pytest.ini_options]\ntestpaths = ["modules/products/tests"]\n'
+)
+
+
+@pytest.fixture
+def repo(tmp_path: Path) -> Path:
+    (tmp_path / "host").mkdir()
+    (tmp_path / "host" / "pyproject.toml").write_text(HOST)
+    (tmp_path / "pyproject.toml").write_text(ROOT_TOML)
+    return tmp_path
+
+
+class TestInsertAfterLastMatch:
+    def test_inserts_after_last_match_and_before_trailer(self):
+        content = "a = 1\nb = 2\n# trailer\n"
+        assert _insert_after_last_match(content, r"^b = 2$", "c = 3\n") == (
+            "a = 1\nb = 2\nc = 3\n# trailer\n"
+        )
+
+    def test_none_without_a_match(self):
+        assert _insert_after_last_match("nothing\n", r"^XYZ$", "x\n") is None
+
+
+class TestUpdateHostPyproject:
+    def test_adds_dependency_and_workspace_source_by_dist_name(self, repo: Path):
+        update_host_pyproject(repo, "orders")
+        content = (repo / "host" / "pyproject.toml").read_text()
+        assert '"simple_module_orders"' in content
+        assert "simple_module_orders = { workspace = true }" in content
+
+    def test_idempotent(self, repo: Path):
+        update_host_pyproject(repo, "orders")
+        once = (repo / "host" / "pyproject.toml").read_text()
+        update_host_pyproject(repo, "orders")
+        assert (repo / "host" / "pyproject.toml").read_text() == once
+
+
+class TestUpdateRootPyproject:
+    def test_inserts_after_last_module_not_after_host(self, repo: Path):
+        update_root_pyproject(repo, "orders")
+        content = (repo / "pyproject.toml").read_text()
+        assert '"modules/orders",\n    "host"' in content
+        assert '"modules/products/tests", "modules/orders/tests"' in content
+
+    def test_idempotent(self, repo: Path):
+        update_root_pyproject(repo, "orders")
+        once = (repo / "pyproject.toml").read_text()
+        update_root_pyproject(repo, "orders")
+        assert (repo / "pyproject.toml").read_text() == once
+
+    def test_warns_without_insertion_point(self, repo: Path, capsys: pytest.CaptureFixture):
+        (repo / "pyproject.toml").write_text("[tool.pytest.ini_options]\ntestpaths = []\n")
+        update_root_pyproject(repo, "orders")
+        assert "warning" in capsys.readouterr().err.lower()
+
+
+RELEASE = (
+    "jobs:\n  publish-pypi:\n    strategy:\n      matrix:\n        package:\n"
+    "          - simple_module_core\n          - simple_module_users\n"
+    "    environment:\n      name: pypi\n  publish-npm:\n    matrix:\n"
+    "          - simple_module_other\n"
+)
+
+
+class TestUpdateReleaseMatrix:
+    def test_appends_to_the_publish_pypi_matrix_only(self, repo: Path):
+        wf = repo / ".github" / "workflows"
+        wf.mkdir(parents=True)
+        (wf / "release.yml").write_text(RELEASE)
+        update_release_matrix(repo, "orders")
+        content = (wf / "release.yml").read_text()
+        assert "- simple_module_users\n          - simple_module_orders\n    environment" in content
+        update_release_matrix(repo, "orders")
+        assert (wf / "release.yml").read_text() == content
+
+
+def _load_script():
+    path = Path(__file__).resolve().parents[3] / "scripts" / "new_module.py"
+    spec = importlib.util.spec_from_file_location("new_module_script", path)
+    assert spec and spec.loader
+    mod = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = mod
+    spec.loader.exec_module(mod)
+    return mod
+
+
+class TestScript:
+    def test_scaffolds_and_wires(self, repo: Path, monkeypatch: pytest.MonkeyPatch):
+        script = _load_script()
+        monkeypatch.setattr(script, "ROOT", repo)
+        monkeypatch.setattr(sys, "argv", ["new_module.py", "orders"])
+        assert script.main() == 0
+        assert (repo / "modules" / "orders" / "orders" / "module.py").is_file()
+        assert '"simple_module_orders"' in (repo / "host" / "pyproject.toml").read_text()
+        assert '"modules/orders/tests"' in (repo / "pyproject.toml").read_text()
+
+    @pytest.mark.parametrize("bad", ["Orders", "blog-posts", "2fast"])
+    def test_rejects_invalid_names(self, repo: Path, monkeypatch: pytest.MonkeyPatch, bad: str):
+        script = _load_script()
+        monkeypatch.setattr(script, "ROOT", repo)
+        monkeypatch.setattr(sys, "argv", ["new_module.py", bad])
+        assert script.main() == 1
+        assert not (repo / "modules" / bad).exists()
diff --git a/framework/cli/tests/test_scaffolding_framework_repo.py b/framework/cli/tests/test_scaffolding_framework_repo.py
new file mode 100644
index 000000000..1fd5dfb9b
--- /dev/null
+++ b/framework/cli/tests/test_scaffolding_framework_repo.py
@@ -0,0 +1,140 @@
+"""``create_module(framework_repo=True)``: the variant ``make new-module`` scaffolds."""
+
+from __future__ import annotations
+
+import ast
+import json
+import tomllib
+from pathlib import Path
+
+import pytest
+from simple_module_cli.case import to_singular
+from simple_module_cli.scaffolding import create_module
+
+
+@pytest.fixture
+def orders(tmp_path: Path) -> Path:
+    return create_module(
+        tmp_path / "orders", name="orders", framework_version="0.0.37", framework_repo=True
+    )
+
+
+class TestToSingular:
+    @pytest.mark.parametrize(
+        ("plural", "singular"),
+        [
+            ("orders", "order"),
+            ("blog_posts", "blog_post"),
+            ("access", "access"),
+            ("inventory", "inventory"),
+            ("status", "status"),
+            ("news", "news"),
+            ("bus", "bus"),
+            ("analysis", "analysis"),
+            ("categories", "category"),
+            ("boxes", "box"),
+            ("classes", "class"),
+            ("data", "data"),
+            ("statuses", "status"),
+            ("buses", "bus"),
+            ("addresses", "address"),
+            ("blog_categories", "blog_category"),
+        ],
+    )
+    def test_singular(self, plural: str, singular: str):
+        assert to_singular(plural) == singular
+
+
+class TestRichModuleContent:
+    """Both variants get the CRUD sample, permissions, menu and locale wiring."""
+
+    @pytest.mark.parametrize("framework_repo", [True, False])
+    def test_every_python_file_parses_and_has_the_crud_layers(self, tmp_path: Path, framework_repo):
+        dest = create_module(tmp_path / "m", name="blog_posts", framework_repo=framework_repo)
+        pkg = dest / "blog_posts"
+        for py in dest.rglob("*.py"):
+            ast.parse(py.read_text(), filename=str(py))
+        for rel in [
+            "constants.py", "models.py", "service.py", "deps.py", "py.typed",
+            "contracts/schemas.py", "locales/en.json", "pages/Browse.tsx", "pages/Edit.tsx",
+        ]:  # fmt: skip
+            assert (pkg / rel).is_file(), rel
+        assert "class BlogPost(Base, AuditMixin, table=True)" in (pkg / "models.py").read_text()
+
+    @pytest.mark.parametrize("framework_repo", [True, False])
+    def test_update_dto_rejects_explicit_null_for_required_columns(
+        self, tmp_path: Path, monkeypatch, framework_repo
+    ):
+        """Omitted = unchanged; an explicit null on a NOT NULL column is a 422, not a 500."""
+        import importlib
+
+        import pydantic
+
+        dest = create_module(tmp_path / "m", name="null_items", framework_repo=framework_repo)
+        monkeypatch.syspath_prepend(str(dest))
+        update = importlib.import_module("null_items.contracts.schemas").NullItemUpdate
+        assert update().model_dump(exclude_unset=True) == {}
+        assert update(description=None).model_dump(exclude_unset=True) == {"description": None}
+        for field in ("name", "is_active"):
+            with pytest.raises(pydantic.ValidationError):
+                update.model_validate({field: None})
+
+    def test_no_magic_strings_in_module_and_endpoints(self, orders: Path):
+        """Permissions, page keys and menu labels come from constants.py."""
+        pkg = orders / "orders"
+        module_py = (pkg / "module.py").read_text()
+        views = (pkg / "endpoints" / "views.py").read_text()
+        assert "label_key=MENU_LABEL_KEY" in module_py
+        assert "register_module_settings(" in module_py
+        assert "app.state.orders =" not in module_py
+        assert "PAGE_BROWSE," in views
+        assert 'render("Orders/' not in views
+        assert '"orders.view"' not in module_py
+        assert 'PERM_ORDERS_VIEW = "orders.view"' in (pkg / "constants.py").read_text()
+
+    def test_locale_catalog_carries_the_menu_key(self, orders: Path):
+        data = json.loads((orders / "orders" / "locales" / "en.json").read_text())
+        assert data["nav"]["title"] == "Orders"
+        assert data["browse"]["new_button"] == "New Order"
+
+
+class TestFrameworkRepoVariant:
+    def test_pyproject_is_workspace_sourced_and_passes_check_metadata(self, orders: Path):
+        data = tomllib.loads((orders / "pyproject.toml").read_text())
+        project = data["project"]
+        assert project["name"] == "simple_module_orders"
+        assert project["license"] == "MIT"
+        assert "simple-module" in project["keywords"]
+        assert "Repository" in project["urls"]
+        assert "simple_module_core==0.0.37" in project["dependencies"]
+        assert data["tool"]["uv"]["sources"]["simple_module_core"] == {"workspace": True}
+        assert project["entry-points"]["simple_module"]["orders"] == "orders.module:OrdersModule"
+
+    def test_readme_license_and_no_ci_workflows(self, orders: Path):
+        readme = (orders / "README.md").read_text()
+        assert len(readme.encode()) >= 500
+        assert readme.startswith("# ") and "Install" in readme and "Usage" in readme
+        assert "MIT License" in (orders / "LICENSE").read_text()
+        assert not (orders / ".github").exists()
+
+    def test_pages_use_typed_i18n_keys(self, orders: Path):
+        for page in ("Browse.tsx", "Create.tsx", "Edit.tsx"):
+            content = (orders / "orders" / "pages" / page).read_text()
+            assert "const { t } = useT();" in content
+            assert "t(keys.orders." in content
+
+    def test_workspace_tsconfig_resolves_ui_from_root_node_modules(self, orders: Path):
+        assert (
+            "../../node_modules/@simple-module-py/ui/src/*"
+            in (orders / "tsconfig.json").read_text()
+        )
+
+    def test_standalone_variant_keeps_literal_pages_and_no_workspace_sources(self, tmp_path: Path):
+        dest = create_module(tmp_path / "m", name="orders")
+        assert "keys." not in (dest / "orders" / "pages" / "Browse.tsx").read_text()
+        assert "tool.uv.sources" not in (dest / "pyproject.toml").read_text()
+        assert not (dest / "LICENSE").exists()
+
+    def test_duplicate_destination_is_refused(self, orders: Path):
+        with pytest.raises(FileExistsError):
+            create_module(orders, name="orders", framework_repo=True)
diff --git a/framework/cli/tests/test_scaffolding_module.py b/framework/cli/tests/test_scaffolding_module.py
index 546d991a0..b3f1c5b89 100644
--- a/framework/cli/tests/test_scaffolding_module.py
+++ b/framework/cli/tests/test_scaffolding_module.py
@@ -235,7 +235,7 @@ async def test_scaffold_has_pages_dir(self, tmp_path):
         create_module(dest, name="Widget")
         pages_dir = dest / "widget" / "pages"
         assert pages_dir.is_dir()
-        assert (pages_dir / "Index.tsx").is_file()
+        assert (pages_dir / "Browse.tsx").is_file()
 
     async def test_pyproject_ships_static_dist_when_present(self, tmp_path):
         """Gap 2b: pyproject.toml must ship <pkg>/static/dist/ inside the wheel.
diff --git a/framework/cli/tests/test_scaffolding_module_js.py b/framework/cli/tests/test_scaffolding_module_js.py
index 45b743aca..999d8b177 100644
--- a/framework/cli/tests/test_scaffolding_module_js.py
+++ b/framework/cli/tests/test_scaffolding_module_js.py
@@ -54,18 +54,21 @@ async def test_ci_has_frontend_job_and_dev_extra_has_cli(self, tmp_path):
 
 
 class TestSamplePage:
-    async def test_scaffold_ships_index_page_and_view(self, tmp_path):
+    async def test_scaffold_ships_browse_page_and_view(self, tmp_path):
         from simple_module_cli.scaffolding import create_module
 
         dest = tmp_path / "simple-module-my-feature"
         create_module(dest, name="MyFeature")
 
-        page = (dest / "my_feature" / "pages" / "Index.tsx").read_text(encoding="utf-8")
+        page = (dest / "my_feature" / "pages" / "Browse.tsx").read_text(encoding="utf-8")
         assert "PageShell" in page
         views = (dest / "my_feature" / "endpoints" / "views.py").read_text(encoding="utf-8")
-        assert '"MyFeature/Index"' in views
+        assert "PAGE_BROWSE" in views
+        constants = (dest / "my_feature" / "constants.py").read_text(encoding="utf-8")
+        assert '"MyFeature/Browse"' in constants
         module_py = (dest / "my_feature" / "module.py").read_text(encoding="utf-8")
-        assert 'view_prefix="/my-feature"' in module_py
+        assert "view_prefix=VIEW_PREFIX" in module_py
+        assert 'VIEW_PREFIX = "/my-feature"' in constants
         assert "register_menu_items" in module_py
 
 
diff --git a/framework/core/pyproject.toml b/framework/core/pyproject.toml
index c59b1f746..c20d8f6d8 100644
--- a/framework/core/pyproject.toml
+++ b/framework/core/pyproject.toml
@@ -22,7 +22,7 @@ classifiers = [
 ]
 dependencies = [
     "babel>=2.14",
-    "fastapi>=0.115",
+    "fastapi>=0.140,<0.157",
     "packaging>=23.0",
     "pydantic>=2.0",
     "pydantic-settings>=2.0",
diff --git a/framework/core/simple_module_core/audit_links.py b/framework/core/simple_module_core/audit_links.py
index 47a561727..bcc6935b0 100644
--- a/framework/core/simple_module_core/audit_links.py
+++ b/framework/core/simple_module_core/audit_links.py
@@ -108,6 +108,33 @@ def __post_init__(self) -> None:
                 f"every row would link to the same page"
             )
 
+    @classmethod
+    def for_model(
+        cls,
+        model: type,
+        *,
+        url_template: str,
+        label: str = "",
+        label_key: str = "",
+        label_resolver: LabelResolver | None = None,
+        label_permission: str = "",
+    ) -> AuditLink:
+        """Build the link for a SQLModel table class.
+
+        Fills ``entity_type`` from ``model.__name__`` (the class name, never the
+        table name) and ``table_name`` from ``model.__tablename__``, so a caller
+        cannot key it off the wrong one. ``model`` must be a table model.
+        """
+        return cls(
+            entity_type=model.__name__,
+            url_template=url_template,
+            label=label,
+            label_key=label_key,
+            table_name=model.__tablename__,
+            label_resolver=label_resolver,
+            label_permission=label_permission,
+        )
+
     def url_for(self, entity_id: str) -> str | None:
         """The row's page, or ``None`` when this kind of row has no screen."""
         if not self.url_template:
diff --git a/framework/core/simple_module_core/durable_events.py b/framework/core/simple_module_core/durable_events.py
index 911c3087a..9dc6f0c13 100644
--- a/framework/core/simple_module_core/durable_events.py
+++ b/framework/core/simple_module_core/durable_events.py
@@ -5,7 +5,8 @@
 written to an outbox in the publisher's own transaction and a worker runs the
 handler later, retrying until it succeeds. The framework only defines the
 contract — the subscription registry, the event (de)serialisation and the
-transport protocol. ``background_tasks`` ships the transport.
+``DurableTransport`` protocol, the extension point for delivery implementations.
+``background_tasks`` ships the framework's implementation.
 
 Handlers are called as ``await handler(event, ctx)`` where ``ctx`` is a
 :class:`DurableContext`. Delivery is at-least-once; a handler that writes only
@@ -36,9 +37,10 @@
 class DurableDeliveryUnavailable(RuntimeError):  # noqa: N818 - name fixed by the design
     """``publish_durable`` was called but no durable transport is installed.
 
-    Durable delivery needs an outbox and a worker; the ``background_tasks``
-    module installs both. Raised instead of silently degrading to in-process
-    delivery, which would drop the guarantee the caller asked for.
+    Durable delivery needs a ``DurableTransport`` implementation; the shipped
+    ``background_tasks`` module provides an outbox and a worker. Raised instead
+    of silently degrading to in-process delivery, which would drop the
+    guarantee the caller asked for.
     """
 
 
diff --git a/framework/core/simple_module_core/events.py b/framework/core/simple_module_core/events.py
index e115128f0..a906c2e06 100644
--- a/framework/core/simple_module_core/events.py
+++ b/framework/core/simple_module_core/events.py
@@ -45,14 +45,15 @@ class EventBus:
     * ``publish_nowait`` — fire-and-forget via pyee's event-loop scheduling.
     * ``publish_durable`` — written to an outbox in the caller's transaction and
       delivered at-least-once by the installed :class:`DurableTransport`
-      (``background_tasks``) to handlers registered with ``subscribe_durable``.
+      to handlers registered with ``subscribe_durable``. The framework ships
+      an implementation in ``background_tasks``.
     """
 
     def __init__(self) -> None:
         self._emitter = AsyncIOEventEmitter()
         self._emitter.on("error", self._on_emitter_error)
         self.durable = DurableRegistry()
-        # Installed by the module that owns the outbox (background_tasks).
+        # DurableTransport is the extension point; background_tasks ships an implementation.
         self.durable_transport: DurableTransport | None = None
 
     @staticmethod
@@ -127,7 +128,8 @@ async def publish_durable(self, event: Event, db: Any) -> None:
         Nothing is delivered unless that transaction commits. In-process
         ``subscribe`` handlers are **not** called; publish separately if you
         want both. Raises :class:`DurableDeliveryUnavailable` when no transport
-        is installed (``background_tasks`` not installed or not started).
+        is installed. Implement :class:`DurableTransport` or enable the shipped
+        ``background_tasks`` implementation.
         """
         transport = self.durable_transport
         if transport is None:
diff --git a/framework/core/simple_module_core/module.py b/framework/core/simple_module_core/module.py
index 115834250..1ca54c1d7 100644
--- a/framework/core/simple_module_core/module.py
+++ b/framework/core/simple_module_core/module.py
@@ -214,8 +214,8 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
 
             def register_audit_links(self, registry):
                 registry.register(
-                    AuditLink(
-                        entity_type=User.__name__,
+                    AuditLink.for_model(
+                        User,
                         url_template="/admin/users/{id}/edit",
                         label="User",
                     )
diff --git a/framework/core/tests/test_audit_links.py b/framework/core/tests/test_audit_links.py
index e6b150311..4695afe79 100644
--- a/framework/core/tests/test_audit_links.py
+++ b/framework/core/tests/test_audit_links.py
@@ -164,3 +164,33 @@ def test_an_empty_template_is_accepted(self) -> None:
     def test_a_non_empty_template_still_has_to_carry_the_id(self) -> None:
         with pytest.raises(ValueError, match="contains no"):
             AuditLink(entity_type="Thing", url_template="/things")
+
+
+class TestForModel:
+    def test_equals_hand_built_link(self) -> None:
+        class Widget:
+            __tablename__ = "widgets_widget"
+
+        built = AuditLink.for_model(
+            Widget,
+            url_template="/w/{id}",
+            label="Widget",
+            label_key="w.audit",
+            label_permission="p",
+        )
+        assert built == AuditLink(
+            entity_type="Widget",
+            url_template="/w/{id}",
+            label="Widget",
+            label_key="w.audit",
+            table_name="widgets_widget",
+            label_permission="p",
+        )
+
+    def test_entity_type_is_class_name_not_table(self) -> None:
+        class Widget:
+            __tablename__ = "widgets_widget"
+
+        link = AuditLink.for_model(Widget, url_template="")
+        assert link.entity_type == "Widget"
+        assert link.table_name == "widgets_widget"
diff --git a/framework/db/simple_module_db/__init__.py b/framework/db/simple_module_db/__init__.py
index 41af536df..6a41984c1 100644
--- a/framework/db/simple_module_db/__init__.py
+++ b/framework/db/simple_module_db/__init__.py
@@ -5,6 +5,7 @@
 from simple_module_db.callbacks import OnCommitCallback
 from simple_module_db.deps import get_db
 from simple_module_db.extensions import UnsupportedDatabaseError, ensure_db_extensions
+from simple_module_db.independent import independent_session
 from simple_module_db.migration_portability import drop_enums_if_postgres
 from simple_module_db.migrations import (
     build_module_metadata,
@@ -13,6 +14,13 @@
     render_item,
 )
 from simple_module_db.mixins import AuditMixin, MultiTenantMixin, SoftDeleteMixin, VersionedMixin
+from simple_module_db.pagination import (
+    Page,
+    PageParams,
+    clamp_page,
+    paginate,
+    total_pages,
+)
 from simple_module_db.provider import DatabaseProvider, detect_provider
 from simple_module_db.search import LIKE_ESCAPE_CHAR, like_contains_pattern, like_prefix_pattern
 from simple_module_db.session import DatabaseState, RequestSession, init_db
@@ -50,6 +58,8 @@
     "MissingTenantError",
     "MultiTenantMixin",
     "OnCommitCallback",
+    "Page",
+    "PageParams",
     "RequestSession",
     "SoftDeleteMixin",
     "TSVector",
@@ -59,6 +69,7 @@
     "all_tenants",
     "bind_current_tenant",
     "build_module_metadata",
+    "clamp_page",
     "create_module_base",
     "current_tenant_id",
     "detect_provider",
@@ -67,6 +78,7 @@
     "finalize_session",
     "get_db",
     "hard_delete",
+    "independent_session",
     "init_db",
     "is_valid_tenant_id",
     "like_contains_pattern",
@@ -75,6 +87,8 @@
     "make_process_revision_directives",
     "mark_written",
     "no_tenant",
+    "paginate",
     "render_item",
     "tenant_context",
+    "total_pages",
 ]
diff --git a/framework/db/simple_module_db/independent.py b/framework/db/simple_module_db/independent.py
new file mode 100644
index 000000000..d0b619351
--- /dev/null
+++ b/framework/db/simple_module_db/independent.py
@@ -0,0 +1,34 @@
+"""A session opened outside the request, with the commit convention in one place."""
+
+from __future__ import annotations
+
+from collections.abc import AsyncGenerator
+from contextlib import asynccontextmanager
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+
+@asynccontextmanager
+async def independent_session(app: Any) -> AsyncGenerator[AsyncSession]:
+    """Open a session from ``app``'s factory, outside any request.
+
+    Commits when the block exits cleanly and rolls back (then re-raises) when it
+    raises, so startup hooks, background cleanups and out-of-band writes do not
+    each hand-roll the pair. The session is closed either way.
+
+    Request code must not use this: the request session (``get_db``) commits in
+    ``CommitBeforeResponseMiddleware``, and a second session cannot see its
+    uncommitted rows. Code that must commit mid-block, never commit, or run on a
+    different engine keeps using ``session_factory()`` directly.
+    """
+    async with app.state.sm.db.session_factory() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+        # Cancellation and other BaseExceptions skip the explicit rollback: awaiting
+        # it there could be cancelled too and mask the original error, and closing
+        # the session discards the open transaction anyway.
diff --git a/framework/db/simple_module_db/pagination.py b/framework/db/simple_module_db/pagination.py
new file mode 100644
index 000000000..0d68dac66
--- /dev/null
+++ b/framework/db/simple_module_db/pagination.py
@@ -0,0 +1,96 @@
+"""Offset pagination: one place that clamps, counts and slices.
+
+``PageParams`` is a plain value (no FastAPI import, so the DB package stays
+web-free); ``simple_module_hosting.pagination`` builds it from query strings.
+``paginate`` counts the *same statement* as a subquery, so soft-delete and
+tenant filters apply to the count exactly as they do to the rows.
+"""
+
+from __future__ import annotations
+
+import math
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any
+
+from sqlalchemy import func, select
+from sqlmodel import SQLModel
+
+if TYPE_CHECKING:
+    from sqlalchemy.ext.asyncio import AsyncSession
+    from sqlalchemy.sql import Select
+
+
+DEFAULT_PER_PAGE = 25
+MAX_PER_PAGE = 200
+MAX_PAGE = 1_000_000
+
+
+def total_pages(total: int, per_page: int) -> int:
+    """Number of pages for ``total`` rows; always at least 1 (an empty list is page 1)."""
+    return max(1, math.ceil(max(total, 0) / max(per_page, 1)))
+
+
+def clamp_page(page: int, total: int, per_page: int) -> int:
+    """``page`` limited to ``1..total_pages`` so a stale link lands on the last real page."""
+    return min(max(page, 1), total_pages(total, per_page))
+
+
+@dataclass(frozen=True, slots=True)
+class PageParams:
+    """A requested page. Values are normalised on construction, never trusted."""
+
+    page: int = 1
+    per_page: int = DEFAULT_PER_PAGE
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "page", max(min(int(self.page), MAX_PAGE), 1))
+        object.__setattr__(self, "per_page", max(1, min(int(self.per_page), MAX_PER_PAGE)))
+
+    @property
+    def offset(self) -> int:
+        """SQL OFFSET for the requested page; never negative."""
+        return (self.page - 1) * self.per_page
+
+
+class Page[T](SQLModel):
+    """One page of results. ``page`` is the page actually served (after clamping)."""
+
+    items: list[T]
+    total: int
+    page: int
+    per_page: int
+    pages: int
+
+
+async def paginate(
+    session: AsyncSession,
+    stmt: Select[Any],
+    params: PageParams,
+    *,
+    scalars: bool = True,
+) -> Page[Any]:
+    """Run ``stmt`` one page at a time.
+
+    ``stmt`` must carry its own ``ORDER BY``. A page past the end is clamped to
+    the last page, so the client never gets an empty list with a non-zero
+    total. ``scalars=False`` returns row objects for multi-column selects.
+    """
+    count_stmt = select(func.count()).select_from(stmt.order_by(None).subquery())
+    # The count wraps ``stmt`` in a new SELECT, so carry its options (include_deleted,
+    # all_tenants) across or the listeners would filter the count differently.
+    count_stmt = count_stmt.execution_options(**stmt.get_execution_options())
+    total = int((await session.execute(count_stmt)).scalar_one())
+    served = PageParams(
+        page=clamp_page(params.page, total, params.per_page), per_page=params.per_page
+    )
+    page = served.page
+    paged = stmt.offset(served.offset).limit(served.per_page)
+    result = await session.execute(paged)
+    items = list(result.scalars().all() if scalars else result.all())
+    return Page(
+        items=items,
+        total=total,
+        page=page,
+        per_page=params.per_page,
+        pages=total_pages(total, params.per_page),
+    )
diff --git a/framework/db/tests/test_db_pagination.py b/framework/db/tests/test_db_pagination.py
new file mode 100644
index 000000000..bb800f357
--- /dev/null
+++ b/framework/db/tests/test_db_pagination.py
@@ -0,0 +1,75 @@
+"""paginate / PageParams: clamping, counting through filters, no negative offset."""
+
+from __future__ import annotations
+
+import pytest
+from simple_module_db import PageParams, clamp_page, paginate, total_pages
+from sqlmodel import Field, SQLModel, select
+
+
+class _Item(SQLModel, table=True):
+    __tablename__ = "pagination_test_item"
+    __table_args__ = {"extend_existing": True}
+    id: int | None = Field(default=None, primary_key=True)
+    n: int = 0
+
+
+def test_params_never_negative_offset():
+    assert PageParams(page=0).offset == 0
+    assert PageParams(page=-5, per_page=10).offset == 0
+    assert PageParams(page=3, per_page=10).offset == 20
+
+
+def test_params_clamp_per_page():
+    assert PageParams(per_page=0).per_page == 1
+    assert PageParams(per_page=10_000).per_page == 200
+
+
+def test_total_pages_and_clamp():
+    assert total_pages(0, 10) == 1
+    assert total_pages(21, 10) == 3
+    assert clamp_page(99, 21, 10) == 3
+    assert clamp_page(0, 21, 10) == 1
+
+
+@pytest.fixture
+async def seeded(db_session):
+    from sqlalchemy import text  # noqa: F401
+
+    conn = await db_session.connection()
+    await conn.run_sync(lambda c: _Item.__table__.create(c, checkfirst=True))
+    db_session.add_all([_Item(n=i) for i in range(23)])
+    await db_session.flush()
+    return db_session
+
+
+async def test_paginate_slices_and_counts(seeded):
+    stmt = select(_Item).order_by(_Item.n)
+    page = await paginate(seeded, stmt, PageParams(page=2, per_page=10))
+    assert (page.total, page.page, page.pages, page.per_page) == (23, 2, 3, 10)
+    assert [i.n for i in page.items] == list(range(10, 20))
+
+
+async def test_paginate_clamps_past_the_end(seeded):
+    stmt = select(_Item).order_by(_Item.n)
+    page = await paginate(seeded, stmt, PageParams(page=50, per_page=10))
+    assert page.page == 3
+    assert [i.n for i in page.items] == [20, 21, 22]
+
+
+async def test_paginate_count_follows_filters(seeded):
+    stmt = select(_Item).where(_Item.n < 5).order_by(_Item.n)
+    page = await paginate(seeded, stmt, PageParams(per_page=2))
+    assert (page.total, page.pages, len(page.items)) == (5, 3, 2)
+
+
+async def test_paginate_empty(seeded):
+    stmt = select(_Item).where(_Item.n > 1000).order_by(_Item.n)
+    page = await paginate(seeded, stmt, PageParams(page=4))
+    assert (page.total, page.page, page.pages, page.items) == (0, 1, 1, [])
+
+
+async def test_paginate_rows(seeded):
+    stmt = select(_Item.n).order_by(_Item.n)
+    page = await paginate(seeded, stmt, PageParams(per_page=3), scalars=False)
+    assert [r.n for r in page.items] == [0, 1, 2]
diff --git a/framework/db/tests/test_db_pagination_options.py b/framework/db/tests/test_db_pagination_options.py
new file mode 100644
index 000000000..91aeb36a1
--- /dev/null
+++ b/framework/db/tests/test_db_pagination_options.py
@@ -0,0 +1,47 @@
+"""paginate carries execution options to the count; huge pages never reach OFFSET."""
+
+from __future__ import annotations
+
+from _models import _TenantItem, _TenantSoftItem
+from simple_module_db import PageParams, paginate, tenant_context
+from simple_module_db.pagination import MAX_PAGE
+from sqlalchemy import select
+
+
+async def test_count_honours_include_deleted(strict_session):
+    with tenant_context("a"):
+        keep, gone = _TenantSoftItem(name="keep"), _TenantSoftItem(name="gone")
+        strict_session.add_all([keep, gone])
+        await strict_session.flush()
+        await strict_session.delete(gone)
+        await strict_session.flush()
+        base = select(_TenantSoftItem).order_by(_TenantSoftItem.id)
+        hidden = await paginate(strict_session, base, PageParams())
+        shown = await paginate(
+            strict_session, base.execution_options(include_deleted=True), PageParams()
+        )
+    assert (hidden.total, len(hidden.items)) == (1, 1)
+    assert (shown.total, len(shown.items)) == (2, 2)
+
+
+async def test_count_honours_all_tenants(strict_session):
+    for tenant in ("a", "b"):
+        with tenant_context(tenant):
+            strict_session.add(_TenantItem(name=tenant))
+            await strict_session.flush()
+    stmt = select(_TenantItem).order_by(_TenantItem.id).execution_options(all_tenants=True)
+    page = await paginate(strict_session, stmt, PageParams())
+    assert (page.total, len(page.items)) == (2, 2)
+
+
+def test_page_is_bounded():
+    assert PageParams(page=10**15).page == MAX_PAGE
+
+
+async def test_paginate_huge_page_serves_last_page(strict_session):
+    with tenant_context("a"):
+        strict_session.add_all([_TenantItem(name=str(i)) for i in range(3)])
+        await strict_session.flush()
+        stmt = select(_TenantItem).order_by(_TenantItem.id)
+        page = await paginate(strict_session, stmt, PageParams(page=10**15, per_page=2))
+    assert (page.page, len(page.items)) == (2, 1)
diff --git a/framework/db/tests/test_independent_session.py b/framework/db/tests/test_independent_session.py
new file mode 100644
index 000000000..d6523cbdf
--- /dev/null
+++ b/framework/db/tests/test_independent_session.py
@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+from simple_module_db import independent_session
+from sqlalchemy import text
+
+
+@pytest.fixture
+def app(db_state):
+    return SimpleNamespace(state=SimpleNamespace(sm=SimpleNamespace(db=db_state)))
+
+
+async def _count(db_state) -> int:
+    async with db_state.session_factory() as s:
+        return (await s.execute(text("SELECT count(*) FROM t_indep"))).scalar_one()
+
+
+@pytest.fixture
+async def t_indep(db_state):
+    # The Postgres suite keeps ad-hoc tables between tests (only module tables are
+    # reset), so create and drop it explicitly.
+    async with db_state.session_factory() as s:
+        await s.execute(text("DROP TABLE IF EXISTS t_indep"))
+        await s.execute(text("CREATE TABLE t_indep (id integer)"))
+        await s.commit()
+    yield
+    async with db_state.session_factory() as s:
+        await s.execute(text("DROP TABLE IF EXISTS t_indep"))
+        await s.commit()
+
+
+@pytest.mark.usefixtures("t_indep")
+async def test_commits_on_success(app, db_state):
+    async with independent_session(app) as s:
+        await s.execute(text("INSERT INTO t_indep VALUES (1)"))
+    assert await _count(db_state) == 1
+
+
+@pytest.mark.usefixtures("t_indep")
+async def test_rolls_back_on_error(app, db_state):
+    with pytest.raises(RuntimeError):
+        async with independent_session(app) as s:
+            await s.execute(text("INSERT INTO t_indep VALUES (1)"))
+            raise RuntimeError("boom")
+    assert await _count(db_state) == 0
diff --git a/framework/hosting/pyproject.toml b/framework/hosting/pyproject.toml
index 47138d3b1..235dc836e 100644
--- a/framework/hosting/pyproject.toml
+++ b/framework/hosting/pyproject.toml
@@ -22,7 +22,7 @@ classifiers = [
 ]
 dependencies = [
     "click>=8.1",
-    "fastapi>=0.115",
+    "fastapi>=0.140,<0.157",
     "httpx>=0.27",
     # SessionMiddleware (starlette.middleware.sessions) imports itsdangerous at
     # module import time; starlette treats it as an optional extra, so declare
diff --git a/framework/hosting/simple_module_hosting/_route_guard.py b/framework/hosting/simple_module_hosting/_route_guard.py
index 58a74410a..59ee63027 100644
--- a/framework/hosting/simple_module_hosting/_route_guard.py
+++ b/framework/hosting/simple_module_hosting/_route_guard.py
@@ -29,6 +29,9 @@
 from typing import Any
 
 from fastapi import FastAPI
+
+# Private APIs: see tests/test_route_guard_fastapi_contract.py before widening
+# the fastapi>=0.140,<0.157 dependency bound.
 from starlette._utils import get_route_path
 from starlette.routing import Match
 from starlette.types import Scope
diff --git a/framework/hosting/simple_module_hosting/pagination.py b/framework/hosting/simple_module_hosting/pagination.py
new file mode 100644
index 000000000..cf5c7b56c
--- /dev/null
+++ b/framework/hosting/simple_module_hosting/pagination.py
@@ -0,0 +1,60 @@
+"""Query-string dependencies that build a ``simple_module_db.PageParams``.
+
+Two flavours, because API and browser routes fail differently:
+
+* ``PageParamsDep`` — strict. ``page`` or ``per_page`` out of range is a
+  422, for JSON APIs whose callers should fix their request.
+* ``LenientPageParamsDep`` — for Inertia views reached from URLs people edit
+  and bookmark. Garbage and out-of-range values clamp instead of rejecting.
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import Depends, Query
+from simple_module_db.pagination import DEFAULT_PER_PAGE, MAX_PAGE, MAX_PER_PAGE, PageParams
+
+
+def page_params(default_per_page: int = DEFAULT_PER_PAGE):
+    """Strict dependency factory: ``Depends(page_params(50))`` for a 50-row default."""
+
+    def dependency(
+        page: int = Query(1, ge=1, le=MAX_PAGE),
+        per_page: int = Query(default_per_page, ge=1, le=MAX_PER_PAGE),
+    ) -> PageParams:
+        return PageParams(page=page, per_page=per_page)
+
+    return dependency
+
+
+def _lenient_int(raw: str | None, fallback: int) -> int:
+    try:
+        return int(raw) if raw is not None else fallback
+    except ValueError:
+        return fallback
+
+
+def lenient_page_params(default_per_page: int = DEFAULT_PER_PAGE):
+    """Clamping dependency factory for browser-facing view routes."""
+
+    def dependency(
+        page: str | None = Query(None),
+        per_page: str | None = Query(None),
+    ) -> PageParams:
+        return PageParams(
+            page=_lenient_int(page, 1), per_page=_lenient_int(per_page, default_per_page)
+        )
+
+    return dependency
+
+
+PageParamsDep = Annotated[PageParams, Depends(page_params())]
+LenientPageParamsDep = Annotated[PageParams, Depends(lenient_page_params())]
+
+__all__ = [
+    "LenientPageParamsDep",
+    "PageParamsDep",
+    "lenient_page_params",
+    "page_params",
+]
diff --git a/framework/hosting/simple_module_hosting/ui_locales/en.json b/framework/hosting/simple_module_hosting/ui_locales/en.json
index bbc3b2f95..9fabe32d4 100644
--- a/framework/hosting/simple_module_hosting/ui_locales/en.json
+++ b/framework/hosting/simple_module_hosting/ui_locales/en.json
@@ -101,5 +101,10 @@
     "unauthorized_title": "Sign in required",
     "unavailable_description": "The service is temporarily unavailable. Please try again shortly.",
     "unavailable_title": "Service unavailable"
+  },
+  "pagination": {
+    "showing": "Showing {from}–{to} of {total}",
+    "previous": "Previous",
+    "next": "Next"
   }
 }
diff --git a/framework/hosting/simple_module_hosting/ui_locales/es.json b/framework/hosting/simple_module_hosting/ui_locales/es.json
index 211dde46a..0ade328df 100644
--- a/framework/hosting/simple_module_hosting/ui_locales/es.json
+++ b/framework/hosting/simple_module_hosting/ui_locales/es.json
@@ -101,5 +101,10 @@
     "unauthorized_title": "Inicio de sesión requerido",
     "unavailable_description": "El servicio no está disponible temporalmente. Inténtalo de nuevo en unos momentos.",
     "unavailable_title": "Servicio no disponible"
+  },
+  "pagination": {
+    "showing": "Mostrando {from}–{to} de {total}",
+    "previous": "Anterior",
+    "next": "Siguiente"
   }
 }
diff --git a/framework/hosting/tests/test_hosting_pagination_deps.py b/framework/hosting/tests/test_hosting_pagination_deps.py
new file mode 100644
index 000000000..8285e8cb0
--- /dev/null
+++ b/framework/hosting/tests/test_hosting_pagination_deps.py
@@ -0,0 +1,51 @@
+"""Strict (422) and lenient (clamp) page-param dependencies."""
+
+from __future__ import annotations
+
+from fastapi import Depends, FastAPI
+from fastapi.testclient import TestClient
+from simple_module_db import PageParams
+from simple_module_hosting.pagination import lenient_page_params, page_params
+
+app = FastAPI()
+
+
+@app.get("/strict")
+def strict(p: PageParams = Depends(page_params(50))) -> dict[str, int]:
+    return {"page": p.page, "per_page": p.per_page, "offset": p.offset}
+
+
+@app.get("/lenient")
+def lenient(p: PageParams = Depends(lenient_page_params(20))) -> dict[str, int]:
+    return {"page": p.page, "per_page": p.per_page, "offset": p.offset}
+
+
+client = TestClient(app)
+
+
+def test_strict_defaults_and_factory_page_size():
+    assert client.get("/strict").json() == {"page": 1, "per_page": 50, "offset": 0}
+
+
+def test_strict_rejects_out_of_range():
+    for q in ("page=0", "page=-1", "per_page=0", "per_page=201", "page=abc"):
+        assert client.get(f"/strict?{q}").status_code == 422, q
+
+
+def test_lenient_clamps_instead_of_rejecting():
+    assert client.get("/lenient?page=-4&per_page=9999").json() == {
+        "page": 1,
+        "per_page": 200,
+        "offset": 0,
+    }
+    assert client.get("/lenient?page=banana").json()["page"] == 1
+    assert client.get("/lenient").json()["per_page"] == 20
+
+
+def test_strict_rejects_page_above_max():
+    assert client.get("/strict?page=1000001").status_code == 422
+    assert client.get("/strict?page=1000000").json()["page"] == 1_000_000
+
+
+def test_lenient_clamps_page_to_max():
+    assert client.get("/lenient?page=99999999999").json()["page"] == 1_000_000
diff --git a/framework/hosting/tests/test_route_guard_fastapi_contract.py b/framework/hosting/tests/test_route_guard_fastapi_contract.py
new file mode 100644
index 000000000..e73978e88
--- /dev/null
+++ b/framework/hosting/tests/test_route_guard_fastapi_contract.py
@@ -0,0 +1,94 @@
+"""Upgrade contract for the private APIs used by simple_module_hosting._route_guard."""
+
+import inspect
+
+import fastapi.routing as routing
+import starlette._utils as starlette_utils
+from fastapi import APIRouter, FastAPI
+from starlette.routing import Match
+
+GUARD = "framework/hosting/simple_module_hosting/_route_guard.py"
+
+
+def _accepts(fn, name, *args):
+    message = f"{name} must be callable with {len(args)} positional arguments; update {GUARD}"
+    assert callable(fn), message
+    try:
+        inspect.signature(fn).bind(*args)
+    except (TypeError, ValueError) as exc:
+        raise AssertionError(message) from exc
+    return fn
+
+
+def test_private_routing_contract():
+    included_type = getattr(routing, "_IncludedRouter", None)
+    assert inspect.isclass(included_type), (
+        f"fastapi.routing._IncludedRouter must be a class; update {GUARD}"
+    )
+    get_route_path = getattr(starlette_utils, "get_route_path", None)
+    scope = {"type": "http", "path": "/api/item", "root_path": "", "method": "GET"}
+    get_route_path = _accepts(get_route_path, "starlette._utils.get_route_path(scope)", scope)
+    assert get_route_path(scope) == "/api/item", (
+        f"get_route_path must return the route path string; update {GUARD}"
+    )
+
+    app = FastAPI()
+    router = APIRouter()
+
+    @router.get("/api/item")
+    async def item():
+        return {}
+
+    app.include_router(router)
+    included = next(
+        (route for route in app.router.routes if isinstance(route, included_type)), None
+    )
+    assert included is not None, f"include_router must create an _IncludedRouter; update {GUARD}"
+    assert getattr(included, "original_router", None) is router, (
+        f"_IncludedRouter.original_router must retain the APIRouter; update {GUARD}"
+    )
+    version = getattr(router, "_get_routes_version", None)
+    version = _accepts(version, "original_router._get_routes_version()")
+    assert isinstance(version(), int), f"_get_routes_version() must return an int; update {GUARD}"
+
+    contexts = getattr(included, "effective_route_contexts", None)
+    contexts = _accepts(contexts, "_IncludedRouter.effective_route_contexts()")
+    resolved = list(contexts())
+    assert resolved, f"effective_route_contexts() must yield route contexts; update {GUARD}"
+    for ctx in resolved:
+        assert hasattr(ctx, "starlette_route"), (
+            f"route context must expose starlette_route; update {GUARD}"
+        )
+        assert isinstance(getattr(ctx, "path", None), str), (
+            f"route context must expose a string path; update {GUARD}"
+        )
+        if ctx.starlette_route is not None:
+            assert isinstance(getattr(ctx.starlette_route, "path", None), str), (
+                f"context.starlette_route must expose a string path; update {GUARD}"
+            )
+
+    matches = getattr(included, "matches", None)
+    matches = _accepts(matches, "_IncludedRouter.matches(scope)", scope)
+    result = matches(scope)
+    assert isinstance(result, tuple) and len(result) == 2, (
+        f"matches(scope) must return (Match, Scope); update {GUARD}"
+    )
+    assert isinstance(result[0], Match) and isinstance(result[1], dict), (
+        f"matches(scope) must return (Match, Scope); update {GUARD}"
+    )
+
+    def replacement(scope):
+        return Match.NONE, {}
+
+    try:
+        included.matches = replacement
+    except (AttributeError, TypeError) as exc:
+        raise AssertionError(
+            f"_IncludedRouter.matches must allow instance assignment; update {GUARD}"
+        ) from exc
+    assert included.matches is replacement, (
+        f"_IncludedRouter.matches must retain the assigned callable; update {GUARD}"
+    )
+    assert included.matches(scope) == (Match.NONE, {}), (
+        f"assigned matches(scope) must be callable; update {GUARD}"
+    )
diff --git a/framework/inertia/pyproject.toml b/framework/inertia/pyproject.toml
index 1a932e0c5..9f446bb2b 100644
--- a/framework/inertia/pyproject.toml
+++ b/framework/inertia/pyproject.toml
@@ -19,7 +19,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "fastapi>=0.115",
+    "fastapi>=0.140,<0.157",
     "jinja2>=3.1",
     "starlette>=0.44",
 ]
diff --git a/framework/testing/pyproject.toml b/framework/testing/pyproject.toml
index f9af127bc..70c1ea4db 100644
--- a/framework/testing/pyproject.toml
+++ b/framework/testing/pyproject.toml
@@ -21,7 +21,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "fastapi>=0.115",
+    "fastapi>=0.140,<0.157",
     "httpx>=0.27",
     "pytest>=8.0",
     "pytest-asyncio>=0.24",
diff --git a/modules/api_tokens/api_tokens/audit.py b/modules/api_tokens/api_tokens/audit.py
index 999cdf178..d8fd64dbe 100644
--- a/modules/api_tokens/api_tokens/audit.py
+++ b/modules/api_tokens/api_tokens/audit.py
@@ -42,11 +42,10 @@ async def resolve_token_labels(db: AsyncSession, ids: list[str]) -> dict[str, st
 
 
 def build_token_audit_link() -> AuditLink:
-    return AuditLink(
-        entity_type=ApiToken.__name__,
+    return AuditLink.for_model(
+        ApiToken,
         url_template=f"{ADMIN_URL}?{QP_TOKEN}={{id}}",
         label=AUDIT_LINK_LABEL,
         label_key=AUDIT_LINK_LABEL_KEY,
-        table_name=ApiToken.__tablename__,
         label_resolver=resolve_token_labels,
     )
diff --git a/modules/api_tokens/api_tokens/resolver.py b/modules/api_tokens/api_tokens/resolver.py
index 883a44266..c7f0d8649 100644
--- a/modules/api_tokens/api_tokens/resolver.py
+++ b/modules/api_tokens/api_tokens/resolver.py
@@ -22,7 +22,7 @@
 from auth.contracts.tokens import AUTH_KIND_PAT, AUTH_KIND_SERVICE, is_api_token, parse_bearer
 from simple_module_core.tenancy import is_tenant_role
 from simple_module_core.user_directory import UserDirectory, get_user_directory
-from simple_module_db import ALL_TENANTS_OPTION
+from simple_module_db import ALL_TENANTS_OPTION, independent_session
 from sqlalchemy import or_, select, update
 from starlette.requests import Request
 
@@ -119,9 +119,8 @@ async def touch_last_used(app: Any, token: ApiToken, now: datetime) -> None:
         .execution_options(**{ALL_TENANTS_OPTION: True})
     )
     try:
-        async with app.state.sm.db.session_factory() as db:
+        async with independent_session(app) as db:
             await db.execute(stmt)
-            await db.commit()
     except Exception:
         logger.warning("api_tokens: could not record last use of %s", token.id, exc_info=True)
 
diff --git a/modules/audit_log/audit_log/endpoints/api.py b/modules/audit_log/audit_log/endpoints/api.py
index ba53042df..76ff4ddff 100644
--- a/modules/audit_log/audit_log/endpoints/api.py
+++ b/modules/audit_log/audit_log/endpoints/api.py
@@ -8,6 +8,7 @@
 from fastapi.responses import StreamingResponse
 from simple_module_core.user_directory import get_user_directory
 from simple_module_db.deps import get_db
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
 from simple_module_hosting.permissions import RequiresPermission, resolved_permissions_for
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -34,8 +35,8 @@ async def list_audit_entries(
     tenant_id: str | None = Query(default=None),
     from_date: datetime | None = Query(default=None),
     to_date: datetime | None = Query(default=None),
-    page: int = Query(default=1, ge=1),
-    page_size: int = Query(default=DEFAULT_PAGE_SIZE, ge=1, le=200),
+    page: int = Query(default=1, ge=1, le=MAX_PAGE),
+    page_size: int = Query(default=DEFAULT_PAGE_SIZE, ge=1, le=MAX_PER_PAGE),
 ) -> AuditEntryList:
     return await service.list_entries(
         entity_type=entity_type,
diff --git a/modules/audit_log/audit_log/endpoints/views.py b/modules/audit_log/audit_log/endpoints/views.py
index 9d16dc81b..7a50b1980 100644
--- a/modules/audit_log/audit_log/endpoints/views.py
+++ b/modules/audit_log/audit_log/endpoints/views.py
@@ -2,13 +2,13 @@
 
 from __future__ import annotations
 
-import math
 from datetime import datetime
 
 from fastapi import APIRouter, Depends, Query, Request
 from simple_module_core.audit_links import AuditLinkRegistry
 from simple_module_core.user_directory import get_user_directory
 from simple_module_db.deps import get_db
+from simple_module_db.pagination import PageParams, clamp_page
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.inertia_deps import InertiaDep
 from simple_module_hosting.permissions import RequiresPermission, resolved_permissions_for
@@ -18,7 +18,6 @@
 from audit_log.constants import (
     API_PREFIX,
     DEFAULT_PAGE_SIZE,
-    MAX_PAGE_SIZE,
     PAGE_BROWSE,
     PERM_VIEW,
     PLATFORM_TENANT_FILTER,
@@ -87,8 +86,8 @@ async def browse(
 ) -> InertiaResponse:
     directory = get_user_directory(request.app)
     # Sanitize pagination — never raise a validation error for bad values.
-    page_int = max(_safe_int(page, 1), 1)
-    page_size_int = max(1, min(_safe_int(page_size, DEFAULT_PAGE_SIZE), MAX_PAGE_SIZE))
+    params = PageParams(page=_safe_int(page, 1), per_page=_safe_int(page_size, DEFAULT_PAGE_SIZE))
+    page_int, page_size_int = params.page, params.per_page
     # The Actor box takes a name or an email as well as an id. Whitespace is
     # not a search: an all-spaces term means the box is empty, not that nobody
     # is called that.
@@ -110,9 +109,9 @@ async def browse(
     # and re-queried — otherwise the client gets an empty `items` list with a
     # nonzero `total`, which renders the correlation banner ("N entries") right
     # above an empty-state saying nothing matches.
-    total_pages = max(1, math.ceil(result.total / page_size_int))
-    if page_int > total_pages:
-        page_int = total_pages
+    clamped = clamp_page(page_int, result.total, page_size_int)
+    if clamped != page_int:
+        page_int = clamped
         result = await service.list_filtered(filters, page=page_int, page_size=page_size_int)
 
     # Resolve ids for display only — the stored row keeps the bare id, which
diff --git a/modules/audit_log/audit_log/locales/en.json b/modules/audit_log/audit_log/locales/en.json
index 1becc13f8..1f5d7cff7 100644
--- a/modules/audit_log/audit_log/locales/en.json
+++ b/modules/audit_log/audit_log/locales/en.json
@@ -7,10 +7,7 @@
     "empty_description": "Changes to entities will appear here automatically.",
     "no_match_title": "No entries match these filters",
     "no_match_description": "Entries exist outside the current filters.",
-    "clear_filters": "Clear filters",
-    "showing": "Showing {from}–{to} of {total}",
-    "previous": "Previous",
-    "next": "Next"
+    "clear_filters": "Clear filters"
   },
   "filters": {
     "entity_type_label": "Entity type",
diff --git a/modules/audit_log/audit_log/pages/Browse.tsx b/modules/audit_log/audit_log/pages/Browse.tsx
index cffb5620c..c32325eeb 100644
--- a/modules/audit_log/audit_log/pages/Browse.tsx
+++ b/modules/audit_log/audit_log/pages/Browse.tsx
@@ -1,6 +1,7 @@
 import { Head, router, usePage } from '@inertiajs/react';
 import { keys, useT } from '@simple-module-py/i18n';
 import { PageShell } from '@simple-module-py/ui/components/PageShell';
+import { PaginationBar } from '@simple-module-py/ui/components/PaginationBar';
 import { Button } from '@simple-module-py/ui/components/ui/button';
 import { Card } from '@simple-module-py/ui/components/ui/card';
 import { AdminLayout } from '@simple-module-py/ui/layouts/AdminLayout';
@@ -16,7 +17,6 @@ import {
   FilterBar,
   type FilterState,
 } from './components/FilterBar';
-import { Pager } from './components/Pager';
 
 interface Props {
   items: AuditEntryRead[];
@@ -174,11 +174,11 @@ function Browse() {
             />
           )}
 
-          <Pager
+          <PaginationBar
             page={page}
-            pageSize={page_size}
+            perPage={page_size}
             total={total}
-            onPage={(next) => navigate(state, next)}
+            onPageChange={(next) => navigate(state, next)}
           />
         </Card>
       </PageShell>
diff --git a/modules/audit_log/audit_log/pages/components/Pager.tsx b/modules/audit_log/audit_log/pages/components/Pager.tsx
deleted file mode 100644
index 86df607d9..000000000
--- a/modules/audit_log/audit_log/pages/components/Pager.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { keys, useT } from '@simple-module-py/i18n';
-import { Button } from '@simple-module-py/ui/components/ui/button';
-
-interface Props {
-  page: number;
-  pageSize: number;
-  total: number;
-  onPage: (page: number) => void;
-}
-
-/** The table footer: which slice is on screen, and the way to the next one.
- *
- * Always rendered, one page or forty: the range is how a reader checks the
- * filter matched what they expected, and "Showing 0–0 of 0" is the honest
- * answer when it matched nothing.
- */
-export function Pager({ page, pageSize, total, onPage }: Props) {
-  const { t } = useT();
-  const totalPages = Math.max(1, Math.ceil(total / pageSize));
-  const from = total === 0 ? 0 : (page - 1) * pageSize + 1;
-  const to = Math.min(page * pageSize, total);
-
-  return (
-    <div className="flex items-center justify-between border-t px-4 py-3 text-sm text-muted-foreground">
-      <span>{t(keys.audit_log.browse.showing, { from, to, total: total.toLocaleString() })}</span>
-      <div className="flex items-center gap-2">
-        <Button
-          variant="outline"
-          size="sm"
-          className="max-lg:min-h-11"
-          disabled={page <= 1}
-          onClick={() => onPage(page - 1)}
-        >
-          {t(keys.audit_log.browse.previous)}
-        </Button>
-        <Button
-          variant="outline"
-          size="sm"
-          className="max-lg:min-h-11"
-          disabled={page >= totalPages}
-          onClick={() => onPage(page + 1)}
-        >
-          {t(keys.audit_log.browse.next)}
-        </Button>
-      </div>
-    </div>
-  );
-}
diff --git a/modules/audit_log/tests/test_audit_api_pagination_bounds.py b/modules/audit_log/tests/test_audit_api_pagination_bounds.py
new file mode 100644
index 000000000..2036572b0
--- /dev/null
+++ b/modules/audit_log/tests/test_audit_api_pagination_bounds.py
@@ -0,0 +1,29 @@
+"""The audit log JSON API rejects out-of-range paging with 422 (#513)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
+
+LIST_URL = "/api/audit_log/"
+
+
+@pytest.mark.parametrize(
+    "params",
+    [
+        {"page": 0},
+        {"page": -3},
+        {"page": MAX_PAGE + 1},
+        {"page_size": 0},
+        {"page_size": MAX_PER_PAGE + 1},
+    ],
+)
+async def test_rejects_out_of_range(params: dict, authenticated_client: httpx.AsyncClient) -> None:
+    resp = await authenticated_client.get(LIST_URL, params=params)
+    assert resp.status_code == 422
+
+
+async def test_accepts_max_page(authenticated_client: httpx.AsyncClient) -> None:
+    resp = await authenticated_client.get(LIST_URL, params={"page": MAX_PAGE})
+    assert resp.status_code == 200
diff --git a/modules/audit_log/tests/test_huge_page.py b/modules/audit_log/tests/test_huge_page.py
index b551fa56e..2ed4e43cd 100644
--- a/modules/audit_log/tests/test_huge_page.py
+++ b/modules/audit_log/tests/test_huge_page.py
@@ -15,7 +15,7 @@ async def test_view_with_huge_page_clamps(authenticated_client) -> None:
     assert resp.json()["props"]["page"] == 1
 
 
-async def test_api_with_huge_page_does_not_500(authenticated_client) -> None:
+async def test_api_with_huge_page_is_422(authenticated_client) -> None:
     resp = await authenticated_client.get("/api/audit_log/", params={"page": HUGE})
-    assert resp.status_code == 200, resp.text
-    assert resp.json()["items"] == []
+    # Past MAX_PAGE the strict dependency rejects it before any offset is built.
+    assert resp.status_code == 422, resp.text
diff --git a/modules/background_tasks/background_tasks/endpoints/api_admin.py b/modules/background_tasks/background_tasks/endpoints/api_admin.py
index 472a1a099..77b036a75 100644
--- a/modules/background_tasks/background_tasks/endpoints/api_admin.py
+++ b/modules/background_tasks/background_tasks/endpoints/api_admin.py
@@ -5,6 +5,8 @@
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from simple_module_db.pagination import PageParams
+from simple_module_hosting.pagination import page_params
 from simple_module_hosting.permissions import RequiresPermission
 
 from background_tasks.constants import (
@@ -38,8 +40,7 @@ async def list_executions(
     task_name: str | None = Query(default=None, deprecated=True),
     queue: str | None = Query(default=None),
     tenant_id: str | None = Query(default=None),
-    page: int = Query(default=1, ge=1),
-    per_page: int = Query(default=20, ge=1, le=200),
+    params: PageParams = Depends(page_params(20)),
     service: BackgroundTaskService = Depends(get_background_task_service),
 ) -> TaskExecutionListResponse:
     """List executions, filtered exactly as the page filters them.
@@ -55,8 +56,8 @@ async def list_executions(
         task_name=q or task_name,
         queue=queue,
         tenant_id=tenant_id,
-        page=page,
-        per_page=per_page,
+        page=params.page,
+        per_page=params.per_page,
     )
 
 
diff --git a/modules/background_tasks/background_tasks/endpoints/outbox_api.py b/modules/background_tasks/background_tasks/endpoints/outbox_api.py
index d72d1a699..5b95f9b71 100644
--- a/modules/background_tasks/background_tasks/endpoints/outbox_api.py
+++ b/modules/background_tasks/background_tasks/endpoints/outbox_api.py
@@ -5,6 +5,8 @@
 import uuid
 
 from fastapi import APIRouter, Depends, Query, Response
+from simple_module_db.pagination import PageParams
+from simple_module_hosting.pagination import page_params
 from simple_module_hosting.permissions import RequiresPermission
 
 from background_tasks.constants import (
@@ -28,12 +30,11 @@
 @router.get("", response_model=OutboxListResponse)
 async def list_outbox(
     status: OutboxStatus | None = Query(default=None),
-    page: int = Query(default=1, ge=1),
-    per_page: int = Query(default=20, ge=1, le=200),
+    params: PageParams = Depends(page_params(20)),
     service: OutboxService = Depends(get_outbox_service),
 ) -> OutboxListResponse:
     """Undelivered durable events (pending, running, dead), newest first."""
-    return await service.list(status_filter=status, page=page, per_page=per_page)
+    return await service.list(status_filter=status, page=params.page, per_page=params.per_page)
 
 
 @router.post(
diff --git a/modules/background_tasks/background_tasks/endpoints/outbox_views.py b/modules/background_tasks/background_tasks/endpoints/outbox_views.py
index 99f0328f0..360d4a478 100644
--- a/modules/background_tasks/background_tasks/endpoints/outbox_views.py
+++ b/modules/background_tasks/background_tasks/endpoints/outbox_views.py
@@ -3,7 +3,9 @@
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends, Query
+from simple_module_db.pagination import PageParams
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.pagination import lenient_page_params
 from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
 
@@ -20,10 +22,12 @@
 async def outbox(
     inertia: InertiaDep,
     status: OutboxStatus | None = Query(default=None),
-    page: int = Query(default=1, ge=1),
+    params: PageParams = Depends(lenient_page_params(PER_PAGE)),
     service: OutboxService = Depends(get_outbox_service),
 ) -> InertiaResponse:
-    response = await service.list(status_filter=status, page=page, per_page=PER_PAGE)
+    # Fixed page size: the page's Previous/Next navigation carries only ``page``, so
+    # honouring a hand-edited ``?per_page=`` would skip rows on the next click.
+    response = await service.list(status_filter=status, page=params.page, per_page=PER_PAGE)
     return await inertia.render(
         "BackgroundTasks/Outbox",
         {
diff --git a/modules/background_tasks/background_tasks/endpoints/views.py b/modules/background_tasks/background_tasks/endpoints/views.py
index faddc7e78..909ae0ed3 100644
--- a/modules/background_tasks/background_tasks/endpoints/views.py
+++ b/modules/background_tasks/background_tasks/endpoints/views.py
@@ -6,7 +6,9 @@
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from simple_module_db.pagination import PageParams
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.pagination import lenient_page_params
 from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
 
@@ -56,7 +58,7 @@ async def index(
     task_name: str = Query(default="", alias="q"),
     queue: str = Query(default=""),
     tenant_id: str = Query(default="", alias="tenant"),
-    page: int = Query(default=1),
+    params: PageParams = Depends(lenient_page_params(PER_PAGE)),
     service: BackgroundTaskService = Depends(get_background_task_service),
 ) -> InertiaResponse:
     response = await service.list(
@@ -64,7 +66,7 @@ async def index(
         task_name=task_name or None,
         queue=queue or None,
         tenant_id=tenant_id or None,
-        page=page,
+        page=params.page,
         per_page=PER_PAGE,
     )
     # A filtered-empty list says nothing about the fleet, so don't pay to poll
diff --git a/modules/background_tasks/background_tasks/locales/en.json b/modules/background_tasks/background_tasks/locales/en.json
index 814789c7e..9f8118f21 100644
--- a/modules/background_tasks/background_tasks/locales/en.json
+++ b/modules/background_tasks/background_tasks/locales/en.json
@@ -5,9 +5,6 @@
     "search_placeholder": "Search by task name…",
     "workers_button": "Workers",
     "retry_all_button": "Retry all failed",
-    "previous": "Previous",
-    "next": "Next",
-    "showing": "Showing {from}–{to} of {total}",
     "outbox_button": "Outbox"
   },
   "strip": {
diff --git a/modules/background_tasks/background_tasks/module.py b/modules/background_tasks/background_tasks/module.py
index 318bedd8e..343949e29 100644
--- a/modules/background_tasks/background_tasks/module.py
+++ b/modules/background_tasks/background_tasks/module.py
@@ -97,14 +97,11 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
         from background_tasks.models import TaskExecution
 
         registry.register(
-            AuditLink(
-                # Class name, not __tablename__ — see AuditLink.entity_type.
-                # The table name travels alongside as the audit log's type tag.
-                entity_type=TaskExecution.__name__,
+            AuditLink.for_model(
+                TaskExecution,
                 url_template=f"{VIEW_PREFIX}/{{id}}",
                 label="Task execution",
                 label_key="background_tasks.audit.task_execution",
-                table_name=TaskExecution.__tablename__,
                 label_resolver=_resolve_execution_labels,
             )
         )
diff --git a/modules/background_tasks/background_tasks/outbox_service.py b/modules/background_tasks/background_tasks/outbox_service.py
index c9b5367ec..28137b0a5 100644
--- a/modules/background_tasks/background_tasks/outbox_service.py
+++ b/modules/background_tasks/background_tasks/outbox_service.py
@@ -7,6 +7,7 @@
 from typing import TYPE_CHECKING, Any
 
 from fastapi import HTTPException, status
+from simple_module_db.pagination import PageParams, paginate
 from sqlalchemy import delete, false, func, select, update
 
 from background_tasks.constants import OutboxStatus
@@ -61,23 +62,18 @@ async def list(
     ) -> OutboxListResponse:
         statuses = [status_filter] if status_filter else list(OPEN_STATUSES)
         where = [OutboxMessage.status.in_(statuses), *self.scope.conditions()]
-        total = (
-            await self.db.execute(select(func.count()).select_from(OutboxMessage).where(*where))
-        ).scalar_one()
-        rows = (
-            await self.db.execute(
-                select(OutboxMessage)
-                .where(*where)
-                .order_by(OutboxMessage.created_at.desc(), OutboxMessage.id)  # ty: ignore[invalid-argument-type]
-                .offset((page - 1) * per_page)
-                .limit(per_page)
-            )
-        ).scalars()
+        found = await paginate(
+            self.db,
+            select(OutboxMessage)
+            .where(*where)
+            .order_by(OutboxMessage.created_at.desc(), OutboxMessage.id),  # ty: ignore[invalid-argument-type]
+            PageParams(page=page, per_page=per_page),
+        )
         return OutboxListResponse(
-            items=[OutboxItem.model_validate(r) for r in rows],
-            total=total,
-            page=page,
-            per_page=per_page,
+            items=[OutboxItem.model_validate(r) for r in found.items],
+            total=found.total,
+            page=found.page,
+            per_page=found.per_page,
             counts=await self.counts(),
         )
 
diff --git a/modules/background_tasks/background_tasks/pages/components/ExecutionsTable.tsx b/modules/background_tasks/background_tasks/pages/components/ExecutionsTable.tsx
index 7583cd83d..06346de96 100644
--- a/modules/background_tasks/background_tasks/pages/components/ExecutionsTable.tsx
+++ b/modules/background_tasks/background_tasks/pages/components/ExecutionsTable.tsx
@@ -1,5 +1,5 @@
 import { keys, useT } from '@simple-module-py/i18n';
-import { Button } from '@simple-module-py/ui/components/ui/button';
+import { PaginationBar } from '@simple-module-py/ui/components/PaginationBar';
 import { Card } from '@simple-module-py/ui/components/ui/card';
 import {
   Table,
@@ -49,9 +49,6 @@ export function ExecutionsTable({
   empty,
 }: Props) {
   const { t } = useT();
-  const totalPages = Math.max(1, Math.ceil(total / perPage));
-  const from = total === 0 ? 0 : (page - 1) * perPage + 1;
-  const to = Math.min(page * perPage, total);
 
   return (
     <Card className="overflow-hidden py-0">
@@ -89,35 +86,7 @@ export function ExecutionsTable({
           {executions.length === 0 && empty}
         </TableBody>
       </Table>
-      <div className="flex items-center justify-between border-t px-4 py-3 text-sm text-muted-foreground">
-        <span>
-          {t(keys.background_tasks.index.showing, {
-            from,
-            to,
-            total: total.toLocaleString(),
-          })}
-        </span>
-        <div className="flex items-center gap-2">
-          <Button
-            variant="outline"
-            size="sm"
-            className="max-lg:min-h-11"
-            disabled={page <= 1}
-            onClick={() => onPageChange(page - 1)}
-          >
-            {t(keys.background_tasks.index.previous)}
-          </Button>
-          <Button
-            variant="outline"
-            size="sm"
-            className="max-lg:min-h-11"
-            disabled={page >= totalPages}
-            onClick={() => onPageChange(page + 1)}
-          >
-            {t(keys.background_tasks.index.next)}
-          </Button>
-        </div>
-      </div>
+      <PaginationBar page={page} perPage={perPage} total={total} onPageChange={onPageChange} />
     </Card>
   );
 }
diff --git a/modules/background_tasks/background_tasks/pages/components/OutboxTable.tsx b/modules/background_tasks/background_tasks/pages/components/OutboxTable.tsx
index 79677fe6b..84c24ea77 100644
--- a/modules/background_tasks/background_tasks/pages/components/OutboxTable.tsx
+++ b/modules/background_tasks/background_tasks/pages/components/OutboxTable.tsx
@@ -1,4 +1,5 @@
 import { keys, useT } from '@simple-module-py/i18n';
+import { PaginationBar } from '@simple-module-py/ui/components/PaginationBar';
 import { Button } from '@simple-module-py/ui/components/ui/button';
 import { Card } from '@simple-module-py/ui/components/ui/card';
 import {
@@ -43,9 +44,6 @@ function errorSummary(error: string | null): string {
 export function OutboxTable(props: Props) {
   const { messages, canManage, busyId, onRetry, onDiscard, page, perPage, total } = props;
   const { t } = useT();
-  const totalPages = Math.max(1, Math.ceil(total / perPage));
-  const from = total === 0 ? 0 : (page - 1) * perPage + 1;
-  const to = Math.min(page * perPage, total);
 
   return (
     <Card className="overflow-hidden py-0">
@@ -145,29 +143,12 @@ export function OutboxTable(props: Props) {
           )}
         </TableBody>
       </Table>
-      <div className="flex items-center justify-between border-t px-4 py-3 text-sm text-muted-foreground">
-        <span>
-          {t(keys.background_tasks.index.showing, { from, to, total: total.toLocaleString() })}
-        </span>
-        <div className="flex items-center gap-2">
-          <Button
-            variant="outline"
-            size="sm"
-            disabled={page <= 1}
-            onClick={() => props.onPageChange(page - 1)}
-          >
-            {t(keys.background_tasks.index.previous)}
-          </Button>
-          <Button
-            variant="outline"
-            size="sm"
-            disabled={page >= totalPages}
-            onClick={() => props.onPageChange(page + 1)}
-          >
-            {t(keys.background_tasks.index.next)}
-          </Button>
-        </div>
-      </div>
+      <PaginationBar
+        page={page}
+        perPage={perPage}
+        total={total}
+        onPageChange={props.onPageChange}
+      />
     </Card>
   );
 }
diff --git a/modules/background_tasks/tests/test_bg_pagination_bounds.py b/modules/background_tasks/tests/test_bg_pagination_bounds.py
new file mode 100644
index 000000000..eedd11c3d
--- /dev/null
+++ b/modules/background_tasks/tests/test_bg_pagination_bounds.py
@@ -0,0 +1,51 @@
+"""Consistent page/per_page bounds: JSON APIs reject (422), the outbox view clamps (#513)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
+
+pytestmark = pytest.mark.usefixtures("_stub_celery")
+
+EXECUTIONS_API = "/api/background_tasks/admin/executions"
+OUTBOX_API = "/api/background_tasks/admin/outbox"
+OUTBOX_VIEW = "/admin/background-tasks/outbox"
+INERTIA_HEADERS = {"X-Inertia": "true", "Accept": "application/json"}
+
+BAD_PARAMS = [
+    {"page": 0},
+    {"page": -3},
+    {"page": MAX_PAGE + 1},
+    {"per_page": 0},
+    {"per_page": -1},
+    {"per_page": MAX_PER_PAGE + 1},
+]
+
+
+@pytest.mark.parametrize("url", [EXECUTIONS_API, OUTBOX_API])
+@pytest.mark.parametrize("params", BAD_PARAMS)
+async def test_json_list_rejects_out_of_range(
+    url: str, params: dict, authenticated_client: httpx.AsyncClient
+) -> None:
+    resp = await authenticated_client.get(url, params=params)
+    assert resp.status_code == 422
+
+
+@pytest.mark.parametrize("url", [EXECUTIONS_API, OUTBOX_API])
+async def test_json_list_accepts_max_page(
+    url: str, authenticated_client: httpx.AsyncClient
+) -> None:
+    resp = await authenticated_client.get(url, params={"page": MAX_PAGE})
+    assert resp.status_code == 200
+
+
+@pytest.mark.parametrize("page", ["0", "-3", "abc", str(MAX_PAGE + 1)])
+async def test_outbox_view_clamps_instead_of_422(
+    page: str, authenticated_client: httpx.AsyncClient
+) -> None:
+    resp = await authenticated_client.get(
+        OUTBOX_VIEW, params={"page": page}, headers=INERTIA_HEADERS
+    )
+    assert resp.status_code == 200
+    assert resp.json()["props"]["pagination"]["page"] == 1
diff --git a/modules/feature_flags/feature_flags/module.py b/modules/feature_flags/feature_flags/module.py
index 5598215bd..d4e785f29 100644
--- a/modules/feature_flags/feature_flags/module.py
+++ b/modules/feature_flags/feature_flags/module.py
@@ -103,14 +103,11 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
         from feature_flags.models import FeatureFlagOverride
 
         registry.register(
-            AuditLink(
-                # Class name, not __tablename__ — see AuditLink.entity_type.
-                # The table name travels alongside as the audit log's type tag.
-                entity_type=FeatureFlagOverride.__name__,
+            AuditLink.for_model(
+                FeatureFlagOverride,
                 url_template=f"{MENU_URL}?{QP_OVERRIDE}={{id}}",
                 label=AUDIT_LINK_LABEL,
                 label_key=AUDIT_LINK_LABEL_KEY,
-                table_name=FeatureFlagOverride.__tablename__,
                 label_resolver=_resolve_override_labels,
             )
         )
diff --git a/modules/file_storage/README.md b/modules/file_storage/README.md
index b6cca0951..19384b8f2 100644
--- a/modules/file_storage/README.md
+++ b/modules/file_storage/README.md
@@ -12,6 +12,14 @@ pip install simple_module_file_storage
 pip install "simple_module_file_storage[s3]"
 ```
 
+Install `simple_module_file_storage[tasks]` to include the matching
+`simple_module_background_tasks` package, then enable `background_tasks` and run
+its worker for asynchronous multipart-upload checksums. Run its beat scheduler
+as well for upload cleanup jobs.
+The extras combine as `simple_module_file_storage[s3,tasks]`. Without
+`background_tasks`, uploads still work; completed multipart uploads keep
+`checksum_sha256` null. Streamed uploads compute their checksum inline.
+
 ## What it provides
 
 - `POST /api/file-storage/upload` multipart upload endpoint.
@@ -45,6 +53,7 @@ Backend and S3 credentials are configured from the admin UI at **/settings/modul
 - `simple_module_core`, `simple_module_db`, `simple_module_hosting`, `simple_module_settings`
 - `aiofiles`
 - Optional: `aioboto3` (install the `[s3]` extra)
+- Optional: `simple_module_background_tasks` (install the `[tasks]` extra)
 
 ## License
 
diff --git a/modules/file_storage/file_storage/endpoints/api.py b/modules/file_storage/file_storage/endpoints/api.py
index 5fbba2b13..0a6be2aed 100644
--- a/modules/file_storage/file_storage/endpoints/api.py
+++ b/modules/file_storage/file_storage/endpoints/api.py
@@ -19,7 +19,9 @@
 )
 from fastapi.responses import RedirectResponse
 from simple_module_core.events import EventBus
+from simple_module_db.pagination import PageParams
 from simple_module_hosting.i18n_deps import TranslatorDep
+from simple_module_hosting.pagination import page_params
 from simple_module_hosting.permissions import RequiresPermission
 
 from file_storage import constants, queries
@@ -109,8 +111,7 @@ async def upload_file(
 async def list_files(
     # Strict bounds, matching the background_tasks admin API: JSON callers get
     # a 422 for out-of-range paging, while the Inertia views clamp instead.
-    page: int = Query(default=1, ge=1),
-    per_page: int = Query(default=20, ge=1, le=200),
+    params: PageParams = Depends(page_params(20)),
     q: str | None = Query(
         default=None, description="Case-insensitive substring of the original filename."
     ),
@@ -125,14 +126,14 @@ async def list_files(
     owner: str | None = OwnerScope,
 ) -> StoredFileListOut:
     items, total = await service.list_files(
-        page=page,
-        per_page=per_page,
+        page=params.page,
+        per_page=params.per_page,
         created_by=owner,
         search=q,
         content_type=content_type,
         sort=sort,
     )
-    return StoredFileListOut(items=items, total=total, page=page, per_page=per_page)
+    return StoredFileListOut(items=items, total=total, page=params.page, per_page=params.per_page)
 
 
 @router.get(
diff --git a/modules/file_storage/file_storage/endpoints/views.py b/modules/file_storage/file_storage/endpoints/views.py
index f938b5db7..a00d04e4e 100644
--- a/modules/file_storage/file_storage/endpoints/views.py
+++ b/modules/file_storage/file_storage/endpoints/views.py
@@ -2,12 +2,12 @@
 
 from __future__ import annotations
 
-import math
-
-from fastapi import APIRouter, Depends, Query, Request
+from fastapi import APIRouter, Depends, Request
 from simple_module_core.user_directory import get_user_directory
 from simple_module_db.deps import get_db
+from simple_module_db.pagination import PageParams, clamp_page
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.pagination import lenient_page_params
 from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -32,7 +32,7 @@
 async def browse(
     request: Request,
     inertia: InertiaDep,
-    page: int = Query(default=1),
+    params: PageParams = Depends(lenient_page_params(_PER_PAGE)),
     q: str = "",
     content_type: str = "",
     uploaded_by: str = "",
@@ -40,11 +40,9 @@ async def browse(
     service: FileStorageService = Depends(get_file_storage_service),
     owner: str | None = OwnerScope,
 ) -> InertiaResponse:
-    # A user-supplied page below 1 (0, negative, a hand-edited ?page=) must
-    # clamp to the first page rather than reject — mirrors the past-the-end
-    # clamp below so no value of ?page= can produce a raw validation-error
-    # page for a browser-facing route.
-    page = max(page, 1)
+    # ``lenient_page_params`` clamps a page below 1 (0, negative, a hand-edited
+    # ?page=) to the first page, so no ?page= value can produce a raw
+    # validation-error page for a browser-facing route.
     filters = {
         "search": q or None,
         "content_type": content_type or None,
@@ -60,8 +58,7 @@ async def browse(
     # for the rows first meant fetching, and throwing away, a page nobody would
     # ever see; the total is what decides which page to fetch, so it goes first.
     total = await service.count_files(**filters)
-    total_pages = max(1, math.ceil(total / _PER_PAGE))
-    page = min(page, total_pages)
+    page = clamp_page(params.page, total, _PER_PAGE)
     items = await service.page_of_files(page=page, per_page=_PER_PAGE, **filters)
     # The bucket-wide numbers — usage and both facet lists — come from one
     # scan, cached with a short TTL. They ignore the active filters so the
diff --git a/modules/file_storage/file_storage/module.py b/modules/file_storage/file_storage/module.py
index 268737e19..e4e194ecb 100644
--- a/modules/file_storage/file_storage/module.py
+++ b/modules/file_storage/file_storage/module.py
@@ -124,13 +124,11 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
         from file_storage.models import StoredFile
 
         registry.register(
-            AuditLink(
-                # Class name, not __tablename__ — see AuditLink.entity_type.
-                entity_type=StoredFile.__name__,
+            AuditLink.for_model(
+                StoredFile,
                 url_template="",
                 label="File",
                 label_key=f"{constants.LOCALE_NAMESPACE}.audit.file",
-                table_name=constants.TABLE_STORED_FILE,
                 label_resolver=_resolve_file_labels,
             )
         )
diff --git a/modules/file_storage/file_storage/queries.py b/modules/file_storage/file_storage/queries.py
index 4d035025c..c522661fc 100644
--- a/modules/file_storage/file_storage/queries.py
+++ b/modules/file_storage/file_storage/queries.py
@@ -16,6 +16,7 @@
 from urllib.parse import quote
 
 from simple_module_db import LIKE_ESCAPE_CHAR, like_contains_pattern, like_prefix_pattern
+from simple_module_db.pagination import PageParams
 from sqlalchemy import Select, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -116,8 +117,9 @@ async def page_of_files(
     query = select(StoredFile)
     for clause in filter_clauses(created_by=created_by, search=search, content_type=content_type):
         query = query.where(clause)
+    params = PageParams(page=page, per_page=per_page)
     result = await db.execute(
-        query.order_by(*order_clauses(sort)).offset((page - 1) * per_page).limit(per_page)
+        query.order_by(*order_clauses(sort)).offset(params.offset).limit(params.per_page)
     )
     return [StoredFileOut.model_validate(to_out_dict(r)) for r in result.scalars().all()]
 
diff --git a/modules/file_storage/pyproject.toml b/modules/file_storage/pyproject.toml
index da50b180b..8a179dc28 100644
--- a/modules/file_storage/pyproject.toml
+++ b/modules/file_storage/pyproject.toml
@@ -31,6 +31,7 @@ dependencies = [
 
 [project.optional-dependencies]
 s3 = ["aioboto3>=13"]
+tasks = ["simple_module_background_tasks==0.0.37"]
 
 [project.entry-points.simple_module]
 file_storage = "file_storage.module:FileStorageModule"
@@ -58,3 +59,4 @@ simple_module_core = { workspace = true }
 simple_module_db = { workspace = true }
 simple_module_hosting = { workspace = true }
 simple_module_settings = { workspace = true }
+simple_module_background_tasks = { workspace = true }
diff --git a/modules/file_storage/tests/test_file_storage_without_background_tasks.py b/modules/file_storage/tests/test_file_storage_without_background_tasks.py
new file mode 100644
index 000000000..7c63f99e9
--- /dev/null
+++ b/modules/file_storage/tests/test_file_storage_without_background_tasks.py
@@ -0,0 +1,40 @@
+"""Multipart uploads remain usable without the optional background_tasks integration."""
+
+import builtins
+
+from file_storage_uploads_helpers import API, open_session, upload_all
+
+
+async def test_upload_without_background_tasks(app, authenticated_client, storage, monkeypatch):
+    monkeypatch.delattr(app.state, "background_tasks", raising=False)
+    original_import = builtins.__import__
+    attempted = []
+
+    def without_background_tasks(name, *args, **kwargs):
+        if name == "background_tasks" or name.startswith("background_tasks."):
+            attempted.append(name)
+            raise ImportError("background_tasks is not installed")
+        return original_import(name, *args, **kwargs)
+
+    monkeypatch.setattr(builtins, "__import__", without_background_tasks)
+    data = b"upload without a worker"
+    created = await open_session(authenticated_client, total=len(data))
+    assert created.status_code == 201, created.text
+    upload_id = created.json()["id"]
+    etags = await upload_all(authenticated_client, upload_id, data)
+    done = await authenticated_client.post(
+        f"{API}/uploads/{upload_id}/complete",
+        json={"parts": [{"n": n, "etag": e} for n, e in etags.items()]},
+    )
+    assert done.status_code == 200, done.text
+    file = done.json()["file"]
+    assert file["checksum_sha256"] is None
+    metadata = await authenticated_client.get(f"{API}/files/{file['id']}")
+    assert metadata.status_code == 200, metadata.text
+    assert metadata.json()["checksum_sha256"] is None
+    download = await authenticated_client.get(f"{API}/files/{file['id']}/download")
+    assert download.status_code == 200
+    assert download.content == data
+    assert attempted == [], (
+        "uploads without app.state.background_tasks must not import background_tasks"
+    )
diff --git a/modules/file_storage/tests/test_files_api_pagination_bounds.py b/modules/file_storage/tests/test_files_api_pagination_bounds.py
new file mode 100644
index 000000000..da0e91af7
--- /dev/null
+++ b/modules/file_storage/tests/test_files_api_pagination_bounds.py
@@ -0,0 +1,25 @@
+"""The files JSON list rejects out-of-range paging with 422 (#513)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+from file_storage import constants
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
+
+LIST_FILES = f"{constants.ROUTE_PREFIX_API}{constants.PATH_FILES}"
+
+
+@pytest.mark.parametrize(
+    "params",
+    [
+        {"page": 0},
+        {"page": -3},
+        {"page": MAX_PAGE + 1},
+        {"per_page": 0},
+        {"per_page": MAX_PER_PAGE + 1},
+    ],
+)
+async def test_rejects_out_of_range(params: dict, authenticated_client: httpx.AsyncClient) -> None:
+    resp = await authenticated_client.get(LIST_FILES, params=params)
+    assert resp.status_code == 422
diff --git a/modules/permissions/permissions/module.py b/modules/permissions/permissions/module.py
index 2968bb02e..f00c65c52 100644
--- a/modules/permissions/permissions/module.py
+++ b/modules/permissions/permissions/module.py
@@ -11,6 +11,7 @@
 from simple_module_core.audit_links import AuditLink, AuditLinkRegistry
 from simple_module_core.module import ModuleBase, ModuleMeta
 from simple_module_core.permissions import PermissionRegistry
+from simple_module_db import independent_session
 
 from permissions.constants import _MODULE_AUTH, _MODULE_USERS
 
@@ -66,13 +67,11 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
         from permissions.models import RolePermission
 
         registry.register(
-            AuditLink(
-                # Class name, not __tablename__ — see AuditLink.entity_type.
-                entity_type=RolePermission.__name__,
+            AuditLink.for_model(
+                RolePermission,
                 url_template="",
                 label="Role permission",
                 label_key="permissions.audit.role_permission",
-                table_name=RolePermission.__tablename__,
                 label_resolver=_resolve_role_permission_labels,
             )
         )
@@ -103,10 +102,8 @@ async def on_startup(self, app: FastAPI) -> None:
         """Replay persisted role→permission rows into the live registry."""
         from permissions.service import PermissionService
 
-        db_state = app.state.sm.db
         registry = app.state.sm.permissions
-        async with db_state.session_factory() as db:
+        async with independent_session(app) as db:
             service = PermissionService(db, registry)
             await service.load_all_into_registry()
             await service.sync_admin_all_permissions()
-            await db.commit()
diff --git a/modules/settings/settings/endpoints/views.py b/modules/settings/settings/endpoints/views.py
index 55b60d1f4..6b5c35599 100644
--- a/modules/settings/settings/endpoints/views.py
+++ b/modules/settings/settings/endpoints/views.py
@@ -10,10 +10,10 @@
 from __future__ import annotations
 
 import asyncio
-import math
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import ValidationError
+from simple_module_db.pagination import clamp_page
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.inertia_deps import InertiaDep
 from simple_module_hosting.inertia_utils import redirect_back_with_errors, validation_errors_to_dict
@@ -107,7 +107,7 @@ async def browse(
     # A page past the end (stale ?page= link, or the last row on it was just
     # deleted) is clamped and re-queried — otherwise the client gets an empty
     # list with a nonzero total and renders a blank table.
-    number = min(query.page, max(1, math.ceil(total / query.per_page)))
+    number = clamp_page(query.page, total, query.per_page)
     if number != query.page:
         items, total = await service.list_filtered(
             query.scope_filter, query.q, number, query.per_page
diff --git a/modules/settings/settings/module.py b/modules/settings/settings/module.py
index abbda9876..1ec458e69 100644
--- a/modules/settings/settings/module.py
+++ b/modules/settings/settings/module.py
@@ -128,14 +128,11 @@ def register_audit_links(self, registry: AuditLinkRegistry) -> None:
         from simple_module_db.stored_settings import Setting
 
         registry.register(
-            AuditLink(
-                # Class name, not __tablename__ — see AuditLink.entity_type.
-                # The table name travels alongside as the audit log's type tag.
-                entity_type=Setting.__name__,
+            AuditLink.for_model(
+                Setting,
                 url_template=f"{VIEW_PREFIX}/{{id}}/edit",
                 label="Setting",
                 label_key="settings.audit.setting",
-                table_name=Setting.__tablename__,
                 label_resolver=_resolve_setting_labels,
             )
         )
diff --git a/modules/tenants/tenants/endpoints/admin.py b/modules/tenants/tenants/endpoints/admin.py
index 4acacc5f5..18caa3374 100644
--- a/modules/tenants/tenants/endpoints/admin.py
+++ b/modules/tenants/tenants/endpoints/admin.py
@@ -7,7 +7,9 @@
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends
+from simple_module_db.pagination import PageParams
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.pagination import lenient_page_params
 from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
 
@@ -25,10 +27,16 @@
 
 @views.get("/", response_model=None, dependencies=_VIEW)
 async def browse(
-    inertia: InertiaDep, service: TenantServiceDep, q: str = "", page: int = 1
+    inertia: InertiaDep,
+    service: TenantServiceDep,
+    q: str = "",
+    params: PageParams = Depends(lenient_page_params(_PAGE_SIZE)),
 ) -> InertiaResponse:
-    page = max(page, 1)
-    tenants = await service.list_all(search=q, limit=_PAGE_SIZE, offset=(page - 1) * _PAGE_SIZE)
+    # The page size is fixed: the page's Previous/Next links carry only ``page``,
+    # so honouring a hand-edited ``?per_page=`` would skip rows on the next click.
+    tenants = await service.list_all(
+        search=q, limit=_PAGE_SIZE, offset=(params.page - 1) * _PAGE_SIZE
+    )
     counts = await service.member_counts([t.id for t in tenants])
     return await inertia.render(
         PAGE_ADMIN,
@@ -41,7 +49,7 @@ async def browse(
                 for t in tenants
             ],
             "q": q,
-            "page": page,
+            "page": params.page,
             "has_more": len(tenants) == _PAGE_SIZE,
         },
     )
diff --git a/modules/users/tests/test_api_admin_pagination_bounds.py b/modules/users/tests/test_api_admin_pagination_bounds.py
new file mode 100644
index 000000000..26614c416
--- /dev/null
+++ b/modules/users/tests/test_api_admin_pagination_bounds.py
@@ -0,0 +1,31 @@
+"""``GET /api/users/admin`` validates paging like every other JSON list (#513)."""
+
+from __future__ import annotations
+
+import pytest
+from simple_module_db.pagination import MAX_PAGE, MAX_PER_PAGE
+
+ADMIN_URL = "/api/users/admin"
+
+
+@pytest.mark.parametrize(
+    "params",
+    [
+        {"page": 0},
+        {"page": -3},
+        {"page": MAX_PAGE + 1},
+        {"per_page": 0},
+        {"per_page": -1},
+        {"per_page": MAX_PER_PAGE + 1},
+        {"per_page": 100000},
+    ],
+)
+async def test_rejects_out_of_range(params: dict, admin_client, users_db) -> None:
+    resp = await admin_client.get(ADMIN_URL, params=params)
+    assert resp.status_code == 422
+
+
+async def test_accepts_bounds(admin_client, users_db) -> None:
+    resp = await admin_client.get(ADMIN_URL, params={"page": MAX_PAGE, "per_page": MAX_PER_PAGE})
+    assert resp.status_code == 200
+    assert resp.json() == []
diff --git a/modules/users/users/admin/api.py b/modules/users/users/admin/api.py
index b23988595..8c896aeb6 100644
--- a/modules/users/users/admin/api.py
+++ b/modules/users/users/admin/api.py
@@ -8,6 +8,8 @@
 from fastapi import status as http_status
 from fastapi_users import exceptions as fa_exceptions
 from simple_module_core.events import EventBus
+from simple_module_db.pagination import PageParams
+from simple_module_hosting.pagination import page_params
 from simple_module_hosting.permissions import RequiresPermission
 
 from users.admin.bulk_invite import bulk_router
@@ -50,8 +52,7 @@
 
 @admin_router.get("", response_model=list[UserListItem])
 async def admin_list_users(
-    page: int = 1,
-    per_page: int = 20,
+    params: PageParams = Depends(page_params(20)),
     q: str | None = None,
     status: str | None = None,
     role: str | None = None,
@@ -63,8 +64,8 @@ async def admin_list_users(
     """List all users (paginated, optional search and filters)."""
     _status, _verified, _sort, _order = sanitize_list_filters(status, verified, sort, order)
     items, _ = await service.list_users(
-        page=page,
-        per_page=per_page,
+        page=params.page,
+        per_page=params.per_page,
         search=q,
         status=_status,
         role_name=role or None,
diff --git a/modules/users/users/admin/queries.py b/modules/users/users/admin/queries.py
index 79db143bc..1dc494244 100644
--- a/modules/users/users/admin/queries.py
+++ b/modules/users/users/admin/queries.py
@@ -7,6 +7,7 @@
 from typing import Any, cast
 
 from simple_module_db import LIKE_ESCAPE_CHAR, like_contains_pattern
+from simple_module_db.pagination import PageParams
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
@@ -132,8 +133,7 @@ async def list_users(
         """
         # Clamp here, not in the endpoints: the admin view takes these params
         # raw, and a page<=0 would reach SQL as a negative OFFSET.
-        page = max(page, 1)
-        per_page = max(1, min(per_page, 200))
+        params = PageParams(page=page, per_page=per_page)
         stmt = select(
             User.id,  # ty: ignore[invalid-argument-type]
             User.email,  # ty: ignore[invalid-argument-type]
@@ -197,7 +197,7 @@ async def list_users(
         else:
             order_clause = sort_col.desc() if order == "desc" else sort_col.asc()
 
-        stmt = stmt.order_by(order_clause).offset((page - 1) * per_page).limit(per_page)
+        stmt = stmt.order_by(order_clause).offset(params.offset).limit(params.per_page)
         rows = (await self._db.execute(stmt)).all()
 
         # One batched roles query, grouped in Python — DB-agnostic (no
diff --git a/modules/users/users/admin/views.py b/modules/users/users/admin/views.py
index c964a708a..25d111a61 100644
--- a/modules/users/users/admin/views.py
+++ b/modules/users/users/admin/views.py
@@ -2,13 +2,14 @@
 
 from __future__ import annotations
 
-import math
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from simple_module_db.deps import get_db
+from simple_module_db.pagination import PageParams, clamp_page
 from simple_module_hosting.i18n_deps import TranslatorDep
 from simple_module_hosting.inertia_deps import InertiaDep
+from simple_module_hosting.pagination import lenient_page_params
 from simple_module_hosting.permissions import RequiresPermission
 from simple_module_inertia import InertiaResponse
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -47,8 +48,7 @@ async def admin_index(
     request: Request,
     inertia: InertiaDep,
     service: UserService = Depends(get_user_service),
-    page: int = 1,
-    per_page: int = 20,
+    params: PageParams = Depends(lenient_page_params(20)),
     q: str | None = None,
     status: str | None = None,
     role: str | None = None,
@@ -59,11 +59,10 @@ async def admin_index(
     clean_status, clean_verified, clean_sort, clean_order = sanitize_list_filters(
         status, verified, sort, order
     )
-    # Clamp before building filters, with the same bounds the service applies
-    # internally — the pagination prop must echo the values the query actually
-    # ran with, or ?page=0 renders page-1 rows labelled "Page 0".
-    page = max(page, 1)
-    per_page = max(1, min(per_page, 200))
+    # ``lenient_page_params`` normalises (and tolerates garbage like ``?page=abc``),
+    # so the pagination prop echoes the values the query actually ran with
+    # instead of rendering page-1 rows labelled "Page 0".
+    page, per_page = params.page, params.per_page
     filters = {
         "per_page": per_page,
         "search": q,
@@ -78,10 +77,9 @@ async def admin_index(
     # that page just got deleted) must be clamped and re-queried — otherwise
     # the client gets an empty `users` list with a nonzero `total`, which
     # renders a blank table instead of the last real page.
-    # per_page is already clamped to >= 1 above, so this can't divide by zero.
-    total_pages = max(1, math.ceil(total / per_page))
-    if page > total_pages:
-        page = total_pages
+    clamped = clamp_page(page, total, per_page)
+    if clamped != page:
+        page = clamped
         users, total = await service.list_users(page=page, **filters)
     roles = await service.list_roles()
     aggregates = await service.count_user_states()
diff --git a/modules/users/users/audit.py b/modules/users/users/audit.py
index b426afd5b..3fa226986 100644
--- a/modules/users/users/audit.py
+++ b/modules/users/users/audit.py
@@ -40,15 +40,11 @@ async def resolve_user_labels(db: Any, ids: list[str]) -> dict[str, str]:
 
 def build_user_audit_link(admin_url_prefix: str) -> AuditLink:
     """The registry entry for user rows, rooted at the module's admin route."""
-    return AuditLink(
-        # The model class name — what snapshot_changes records. Keying this
-        # off __tablename__ ("users_user") silently never matches; the table
-        # name travels alongside, as the tag shown beside the row's name.
-        entity_type=User.__name__,
+    return AuditLink.for_model(
+        User,
         url_template=f"{admin_url_prefix}{{id}}",
         label=_LABEL,
         label_key=_LABEL_KEY,
-        table_name=User.__tablename__,
         label_resolver=resolve_user_labels,
         # A name here is the same disclosure the user list makes, so it takes
         # the same permission. Without it, a role holding `audit_log.view` and
diff --git a/packages/i18n/src/generated-resources.ts b/packages/i18n/src/generated-resources.ts
index c11dfa611..61ee34058 100644
--- a/packages/i18n/src/generated-resources.ts
+++ b/packages/i18n/src/generated-resources.ts
@@ -87,11 +87,8 @@ export default {
     'audit_log.browse.empty_description': '',
     'audit_log.browse.empty_title': '',
     'audit_log.browse.export_csv': '',
-    'audit_log.browse.next': '',
     'audit_log.browse.no_match_description': '',
     'audit_log.browse.no_match_title': '',
-    'audit_log.browse.previous': '',
-    'audit_log.browse.showing': '',
     'audit_log.browse.title': '',
     'audit_log.changes.fields_set': '',
     'audit_log.changes.fields_set_one': '',
@@ -168,12 +165,9 @@ export default {
     'background_tasks.filters.tenant_label': '',
     'background_tasks.filters.tenant_platform': '',
     'background_tasks.index.description': '',
-    'background_tasks.index.next': '',
     'background_tasks.index.outbox_button': '',
-    'background_tasks.index.previous': '',
     'background_tasks.index.retry_all_button': '',
     'background_tasks.index.search_placeholder': '',
-    'background_tasks.index.showing': '',
     'background_tasks.index.title': '',
     'background_tasks.index.workers_button': '',
     'background_tasks.nav.background_tasks': '',
@@ -995,6 +989,9 @@ export default {
     'ui.nav_groups.content': '',
     'ui.nav_groups.navigation': '',
     'ui.nav_groups.system': '',
+    'ui.pagination.next': '',
+    'ui.pagination.previous': '',
+    'ui.pagination.showing': '',
     'ui.public_nav.close_menu': '',
     'ui.public_nav.docs': '',
     'ui.public_nav.github': '',
diff --git a/packages/i18n/src/keys.generated.ts b/packages/i18n/src/keys.generated.ts
index 9c08f1c56..fab915734 100644
--- a/packages/i18n/src/keys.generated.ts
+++ b/packages/i18n/src/keys.generated.ts
@@ -122,11 +122,8 @@ export const keys = {
       empty_description: 'audit_log.browse.empty_description',
       empty_title: 'audit_log.browse.empty_title',
       export_csv: 'audit_log.browse.export_csv',
-      next: 'audit_log.browse.next',
       no_match_description: 'audit_log.browse.no_match_description',
       no_match_title: 'audit_log.browse.no_match_title',
-      previous: 'audit_log.browse.previous',
-      showing: 'audit_log.browse.showing',
       title: 'audit_log.browse.title',
     },
     changes: {
@@ -228,12 +225,9 @@ export const keys = {
     },
     index: {
       description: 'background_tasks.index.description',
-      next: 'background_tasks.index.next',
       outbox_button: 'background_tasks.index.outbox_button',
-      previous: 'background_tasks.index.previous',
       retry_all_button: 'background_tasks.index.retry_all_button',
       search_placeholder: 'background_tasks.index.search_placeholder',
-      showing: 'background_tasks.index.showing',
       title: 'background_tasks.index.title',
       workers_button: 'background_tasks.index.workers_button',
     },
@@ -1271,6 +1265,11 @@ export const keys = {
       navigation: 'ui.nav_groups.navigation',
       system: 'ui.nav_groups.system',
     },
+    pagination: {
+      next: 'ui.pagination.next',
+      previous: 'ui.pagination.previous',
+      showing: 'ui.pagination.showing',
+    },
     public_nav: {
       close_menu: 'ui.public_nav.close_menu',
       docs: 'ui.public_nav.docs',
diff --git a/packages/ui/src/components/PaginationBar.test.tsx b/packages/ui/src/components/PaginationBar.test.tsx
new file mode 100644
index 000000000..57d7dcf7e
--- /dev/null
+++ b/packages/ui/src/components/PaginationBar.test.tsx
@@ -0,0 +1,57 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+import { describe, expect, test, vi } from 'vitest';
+
+vi.mock('@simple-module-py/i18n', () => ({
+  useT: () => ({
+    t: (key: string, vars?: Record<string, unknown>) =>
+      key === 'ui.pagination.showing'
+        ? `Showing ${vars?.from}–${vars?.to} of ${vars?.total}`
+        : ({ 'ui.pagination.previous': 'Previous', 'ui.pagination.next': 'Next' }[key] ?? key),
+  }),
+  keys: {
+    ui: {
+      pagination: {
+        showing: 'ui.pagination.showing',
+        previous: 'ui.pagination.previous',
+        next: 'ui.pagination.next',
+      },
+    },
+  },
+}));
+
+import { PaginationBar } from './PaginationBar';
+
+describe('PaginationBar', () => {
+  test('shows the slice and pages forward and back', () => {
+    const onPageChange = vi.fn();
+    render(<PaginationBar page={2} perPage={10} total={25} onPageChange={onPageChange} />);
+    expect(screen.getByText('Showing 11–20 of 25')).toBeTruthy();
+    fireEvent.click(screen.getByText('Next'));
+    fireEvent.click(screen.getByText('Previous'));
+    expect(onPageChange).toHaveBeenNthCalledWith(1, 3);
+    expect(onPageChange).toHaveBeenNthCalledWith(2, 1);
+  });
+
+  test('disables Previous on the first page and Next on the last', () => {
+    const { rerender } = render(
+      <PaginationBar page={1} perPage={10} total={25} onPageChange={() => {}} />,
+    );
+    expect((screen.getByText('Previous') as HTMLButtonElement).disabled).toBe(true);
+    rerender(<PaginationBar page={3} perPage={10} total={25} onPageChange={() => {}} />);
+    expect((screen.getByText('Next') as HTMLButtonElement).disabled).toBe(true);
+    expect(screen.getByText('Showing 21–25 of 25')).toBeTruthy();
+  });
+
+  test('an empty list reads 0–0 and Next is disabled', () => {
+    render(<PaginationBar page={1} perPage={10} total={0} onPageChange={() => {}} />);
+    expect(screen.getByText('Showing 0–0 of 0')).toBeTruthy();
+    expect((screen.getByText('Next') as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  test('hideWhenSinglePage renders nothing for one page', () => {
+    const { container } = render(
+      <PaginationBar page={1} perPage={10} total={5} hideWhenSinglePage onPageChange={() => {}} />,
+    );
+    expect(container.firstChild).toBeNull();
+  });
+});
diff --git a/packages/ui/src/components/PaginationBar.tsx b/packages/ui/src/components/PaginationBar.tsx
new file mode 100644
index 000000000..16de2d84d
--- /dev/null
+++ b/packages/ui/src/components/PaginationBar.tsx
@@ -0,0 +1,66 @@
+import { keys, useT } from '@simple-module-py/i18n';
+import { Button } from '@simple-module-py/ui/components/ui/button';
+import { cn } from '@simple-module-py/ui/lib/utils';
+
+interface PaginationBarProps {
+  /** The page being shown (1-based) — echo the server's value, not the URL's. */
+  page: number;
+  perPage: number;
+  total: number;
+  onPageChange: (page: number) => void;
+  /** Render nothing when everything fits on one page. Off by default: the
+   *  "Showing 0–0 of 0" line is how a reader checks a filter matched. */
+  hideWhenSinglePage?: boolean;
+  className?: string;
+}
+
+/**
+ * The table footer for any list backed by `simple_module_db.paginate`'s
+ * `Page` shape (`page`, `per_page`, `total`): which slice is on screen, plus
+ * Previous / Next.
+ */
+export function PaginationBar({
+  page,
+  perPage,
+  total,
+  onPageChange,
+  hideWhenSinglePage = false,
+  className,
+}: PaginationBarProps) {
+  const { t } = useT();
+  const pages = Math.max(1, Math.ceil(total / Math.max(perPage, 1)));
+  if (hideWhenSinglePage && pages <= 1) return null;
+  const from = total === 0 ? 0 : (page - 1) * perPage + 1;
+  const to = Math.min(page * perPage, total);
+
+  return (
+    <div
+      className={cn(
+        'flex items-center justify-between border-t px-4 py-3 text-sm text-muted-foreground',
+        className,
+      )}
+    >
+      <span>{t(keys.ui.pagination.showing, { from, to, total: total.toLocaleString() })}</span>
+      <div className="flex items-center gap-2">
+        <Button
+          variant="outline"
+          size="sm"
+          className="max-lg:min-h-11"
+          disabled={page <= 1}
+          onClick={() => onPageChange(page - 1)}
+        >
+          {t(keys.ui.pagination.previous)}
+        </Button>
+        <Button
+          variant="outline"
+          size="sm"
+          className="max-lg:min-h-11"
+          disabled={page >= pages}
+          onClick={() => onPageChange(page + 1)}
+        >
+          {t(keys.ui.pagination.next)}
+        </Button>
+      </div>
+    </div>
+  );
+}
diff --git a/packages/ui/src/index.ts b/packages/ui/src/index.ts
index f81b64703..7716a407c 100644
--- a/packages/ui/src/index.ts
+++ b/packages/ui/src/index.ts
@@ -6,6 +6,7 @@ export { InterpolatedText } from './components/InterpolatedText';
 export { NavIcon } from './components/NavIcon';
 export { OfflineBanner } from './components/OfflineBanner';
 export { PageShell } from './components/PageShell';
+export { PaginationBar } from './components/PaginationBar';
 export { PasswordInput } from './components/PasswordInput';
 export {
   PasswordStrength,
diff --git a/scripts/_templates_contracts.py b/scripts/_templates_contracts.py
deleted file mode 100644
index af71fbbb0..000000000
--- a/scripts/_templates_contracts.py
+++ /dev/null
@@ -1,71 +0,0 @@
-"""Template generators for the contracts/ sub-package (DTOs only).
-
-Modules do not ship a Protocol for their service by default. Consumers
-type-hint against the concrete service class exported from
-``<module>.service`` — add a Protocol only when you expect multiple
-implementations or an extension point (see ``file_storage.StorageBackend``
-for the pattern).
-"""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def contracts_init(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """{ctx.class_name} contracts — public interface for other modules."""
-
-        from {ctx.pkg}.contracts.schemas import (
-            {ctx.singular_class}Create,
-            {ctx.singular_class}Out,
-            {ctx.singular_class}Update,
-        )
-
-        __all__ = [
-            "{ctx.singular_class}Create",
-            "{ctx.singular_class}Out",
-            "{ctx.singular_class}Update",
-        ]
-        '''
-
-
-def schemas_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """SQLModel DTOs for the {ctx.class_name} module."""
-
-        from __future__ import annotations
-
-        from datetime import datetime
-
-        from pydantic import ConfigDict
-        from sqlmodel import Field, SQLModel
-
-
-        class {ctx.singular_class}Out(SQLModel):
-            """{ctx.singular_class} data returned by the API."""
-
-            model_config = ConfigDict(from_attributes=True)
-
-            id: int
-            name: str
-            description: str | None = None
-            is_active: bool
-            created_at: datetime | None = None
-            updated_at: datetime | None = None
-
-
-        class {ctx.singular_class}Create(SQLModel):
-            """Data required to create a new {ctx.singular}."""
-
-            name: str = Field(min_length=1, max_length=200)
-            description: str | None = None
-
-
-        class {ctx.singular_class}Update(SQLModel):
-            """Data to update an existing {ctx.singular}. All fields optional."""
-
-            name: str | None = Field(default=None, min_length=1, max_length=200)
-            description: str | None = None
-            is_active: bool | None = None
-        '''
diff --git a/scripts/_templates_endpoints.py b/scripts/_templates_endpoints.py
deleted file mode 100644
index 8a8c55123..000000000
--- a/scripts/_templates_endpoints.py
+++ /dev/null
@@ -1,125 +0,0 @@
-"""Template generators for FastAPI endpoint files (api.py, views.py)."""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def api_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """REST API endpoints for {ctx.class_name}."""
-
-        from __future__ import annotations
-
-        from fastapi import APIRouter, Depends, HTTPException
-
-        from {ctx.pkg}.contracts.schemas import (
-            {ctx.singular_class}Create,
-            {ctx.singular_class}Out,
-            {ctx.singular_class}Update,
-        )
-        from {ctx.pkg}.deps import get_{ctx.singular}_service
-        from {ctx.pkg}.service import {ctx.singular_class}Service
-
-        router = APIRouter()
-
-
-        @router.get("/", response_model=list[{ctx.singular_class}Out])
-        async def list_{ctx.name}(
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> list[{ctx.singular_class}Out]:
-            return await service.get_all()
-
-
-        @router.get("/{{{ctx.singular}_id}}", response_model={ctx.singular_class}Out)
-        async def get_{ctx.singular}(
-            {ctx.singular}_id: int,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> {ctx.singular_class}Out:
-            result = await service.get_by_id({ctx.singular}_id)
-            if result is None:
-                raise HTTPException(status_code=404, detail="{ctx.singular_class} not found")
-            return result
-
-
-        @router.post("/", response_model={ctx.singular_class}Out, status_code=201)
-        async def create_{ctx.singular}(
-            data: {ctx.singular_class}Create,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> {ctx.singular_class}Out:
-            return await service.create(data)
-
-
-        @router.put("/{{{ctx.singular}_id}}", response_model={ctx.singular_class}Out)
-        async def update_{ctx.singular}(
-            {ctx.singular}_id: int,
-            data: {ctx.singular_class}Update,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> {ctx.singular_class}Out:
-            result = await service.update({ctx.singular}_id, data)
-            if result is None:
-                raise HTTPException(status_code=404, detail="{ctx.singular_class} not found")
-            return result
-
-
-        @router.delete("/{{{ctx.singular}_id}}", status_code=204)
-        async def delete_{ctx.singular}(
-            {ctx.singular}_id: int,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> None:
-            deleted = await service.delete({ctx.singular}_id)
-            if not deleted:
-                raise HTTPException(status_code=404, detail="{ctx.singular_class} not found")
-        '''
-
-
-def views_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """Inertia view endpoints for {ctx.class_name}."""
-
-        from __future__ import annotations
-
-        from fastapi import APIRouter, Depends
-        from simple_module_hosting.inertia_deps import InertiaDep
-        from simple_module_inertia import InertiaResponse
-
-        from {ctx.pkg}.deps import get_{ctx.singular}_service
-        from {ctx.pkg}.service import {ctx.singular_class}Service
-
-        router = APIRouter()
-
-
-        @router.get("/", response_model=None)
-        async def browse(
-            inertia: InertiaDep,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> InertiaResponse:
-            items = await service.get_all()
-            return await inertia.render(
-                "{ctx.class_name}/Browse",
-                {{"{ctx.name}": [item.model_dump(mode="json") for item in items]}},
-            )
-
-
-        @router.get("/create", response_model=None)
-        async def create_view(inertia: InertiaDep) -> InertiaResponse:
-            return await inertia.render("{ctx.class_name}/Create")
-
-
-        @router.get("/{{{ctx.singular}_id}}/edit", response_model=None)
-        async def edit_view(
-            {ctx.singular}_id: int,
-            inertia: InertiaDep,
-            service: {ctx.singular_class}Service = Depends(get_{ctx.singular}_service),
-        ) -> InertiaResponse:
-            item = await service.get_by_id({ctx.singular}_id)
-            if item is None:
-                return await inertia.render(
-                    "{ctx.class_name}/Browse",
-                    {{"error": "{ctx.singular_class} not found"}},
-                )
-            return await inertia.render(
-                "{ctx.class_name}/Edit",
-                {{"{ctx.singular}": item.model_dump(mode="json")}},
-            )
-        '''
diff --git a/scripts/_templates_js.py b/scripts/_templates_js.py
deleted file mode 100644
index 1278604d0..000000000
--- a/scripts/_templates_js.py
+++ /dev/null
@@ -1,41 +0,0 @@
-"""JS-workspace file templates (package.json, tsconfig.json) for new_module."""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def package_json(ctx: ScaffoldContext) -> str:
-    return f"""\
-        {{
-          "name": "@simple-module-py/{ctx.pkg.replace("_", "-")}",
-          "version": "0.1.0",
-          "private": true,
-          "description": "Frontend assets for the {ctx.class_name} module",
-          "peerDependencies": {{
-            "react": "^19.0.0",
-            "react-dom": "^19.0.0",
-            "@inertiajs/react": "^3.7.0",
-            "@simple-module-py/ui": "*"
-          }},
-          "devDependencies": {{
-            "@simple-module-py/tsconfig": "*"
-          }},
-          "dependencies": {{}}
-        }}
-        """
-
-
-def tsconfig_json(ctx: ScaffoldContext) -> str:
-    return f"""\
-        {{
-          "extends": "@simple-module-py/tsconfig/base.json",
-          "compilerOptions": {{
-            "paths": {{
-              "@/*": ["./{ctx.pkg}/*"],
-              "@simple-module-py/ui/*": ["../../packages/ui/src/*"]
-            }}
-          }},
-          "include": ["{ctx.pkg}/**/*.ts", "{ctx.pkg}/**/*.tsx"]
-        }}
-        """
diff --git a/scripts/_templates_module.py b/scripts/_templates_module.py
deleted file mode 100644
index 45abf4a43..000000000
--- a/scripts/_templates_module.py
+++ /dev/null
@@ -1,139 +0,0 @@
-"""Template generators for a scaffolded module's definition layer.
-
-Covers the three files that describe the module itself — its ``ModuleBase``
-subclass, its settings, and its ``app.state`` container. Split out of
-``_templates_py`` (which keeps the package/data-layer templates) to stay
-under the repo's 300-line file cap.
-"""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def module_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """{ctx.class_name} module definition."""
-
-        from __future__ import annotations
-
-        import importlib.resources
-        from pathlib import Path
-
-        from fastapi import APIRouter, FastAPI
-        from simple_module_core.menu import MenuItem, MenuRegistry, MenuSection
-        from simple_module_core.module import ModuleBase, ModuleMeta
-        from simple_module_core.module_settings import register_module_settings
-        from simple_module_core.permissions import PermissionRegistry
-
-
-        class {ctx.class_name}Module(ModuleBase):
-            meta = ModuleMeta(
-                name="{ctx.class_name}",
-                route_prefix="/api/{ctx.name}",
-                view_prefix="/{ctx.name}",
-            )
-
-            def register_settings(self, app: FastAPI) -> None:
-                from {ctx.pkg}.services import {ctx.class_name}Services
-                from {ctx.pkg}.settings import {ctx.class_name}Settings
-
-                register_module_settings(
-                    app,
-                    "{ctx.pkg}",
-                    {ctx.class_name}Settings,
-                    lambda s: {ctx.class_name}Services(settings=s),
-                )
-
-            def register_routes(self, api_router: APIRouter, view_router: APIRouter) -> None:
-                from {ctx.pkg}.endpoints.api import router as api
-                from {ctx.pkg}.endpoints.views import router as views
-
-                api_router.include_router(api)
-                view_router.include_router(views)
-
-            def register_menu_items(self, registry: MenuRegistry) -> None:
-                registry.add(
-                    MenuItem(
-                        label="{ctx.class_name}",
-                        url="/{ctx.name}",
-                        icon="box",
-                        order=30,
-                        section=MenuSection.SIDEBAR,
-                        group="Content",
-                    )
-                )
-
-            def register_permissions(self, registry: PermissionRegistry) -> None:
-                registry.add_group(
-                    "{ctx.class_name}",
-                    [
-                        "{ctx.name}.view",
-                        "{ctx.name}.create",
-                        "{ctx.name}.edit",
-                        "{ctx.name}.delete",
-                    ],
-                )
-
-            def locale_dirs(self) -> dict[str, Path]:
-                base = Path(str(importlib.resources.files(__package__) / "locales"))
-                return {{"{ctx.pkg}": base}}
-        '''
-
-
-def settings_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """{ctx.class_name} module settings (DB-backed).
-
-        Values come from the pydantic defaults below at boot, then get hydrated
-        from the settings table by the hosting lifespan before module
-        ``on_startup`` runs (``register_module_settings`` in ``module.py``
-        records the class). ``DbBackedSettings`` reads no environment
-        variables: the DB is the only source. Runtime changes go through the
-        Settings admin screen (``settings.reload.apply_changes_and_reload``).
-
-        Add fields as the module needs them; an empty settings class is fine
-        until then. ``extra="ignore"`` keeps an unknown stored key from
-        breaking boot after a field is removed.
-        """
-
-        from __future__ import annotations
-
-        from pydantic_settings import SettingsConfigDict
-        from simple_module_core.settings_base import DbBackedSettings
-
-
-        class {ctx.class_name}Settings(DbBackedSettings):
-            """Configuration for the {ctx.pkg} module."""
-
-            model_config = SettingsConfigDict(extra="ignore")
-
-            enabled: bool = True
-        '''
-
-
-def services_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """Module-scoped state container.
-
-        Stored as ``app.state.{ctx.pkg}`` by
-        :meth:`{ctx.class_name}Module.register_settings`.
-
-        Not frozen — ``on_startup`` may set fields that depend on the DB or
-        other framework services. Convention: set once during boot, treat as
-        read-only after.
-        """
-
-        from __future__ import annotations
-
-        from dataclasses import dataclass
-
-        from {ctx.pkg}.settings import {ctx.class_name}Settings
-
-
-        @dataclass
-        class {ctx.class_name}Services:
-            """{ctx.class_name} module singletons."""
-
-            settings: {ctx.class_name}Settings
-        '''
diff --git a/scripts/_templates_py.py b/scripts/_templates_py.py
deleted file mode 100644
index b115983b6..000000000
--- a/scripts/_templates_py.py
+++ /dev/null
@@ -1,288 +0,0 @@
-"""Template generators for Python files scaffolded by new_module.
-
-Each function returns the file content for a single generated Python file.
-Context is passed via the ``ScaffoldContext`` dataclass so the signatures
-stay compact.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-
-
-@dataclass(frozen=True)
-class ScaffoldContext:
-    """Naming variables for all generated templates."""
-
-    name: str  # snake_case plural, e.g. "orders"
-    class_name: str  # PascalCase plural, e.g. "Orders"
-    singular: str  # snake_case singular, e.g. "order"
-    singular_class: str  # PascalCase singular, e.g. "Order"
-    pkg: str  # Python package name (same as name today)
-
-
-def pyproject_toml(ctx: ScaffoldContext) -> str:
-    return f"""\
-        [project]
-        name = "simple_module_{ctx.pkg}"
-        version = "0.1.0"
-        description = "The {ctx.class_name} module"
-        readme = "README.md"
-        license = "MIT"
-        license-files = ["LICENSE"]
-        requires-python = ">=3.12"
-        authors = [{{ name = "Anto Subash", email = "antosubash@live.com" }}]
-        keywords = ["simple-module", "{ctx.name}"]
-        dependencies = [
-            "simple_module_core",
-            "simple_module_db",
-            "simple_module_hosting",
-        ]
-
-        [project.entry-points.simple_module]
-        {ctx.name} = "{ctx.pkg}.module:{ctx.class_name}Module"
-
-        [project.urls]
-        Homepage = "https://github.com/antosubash/simple_module_python"
-        Repository = "https://github.com/antosubash/simple_module_python"
-        Issues = "https://github.com/antosubash/simple_module_python/issues"
-        Changelog = "https://github.com/antosubash/simple_module_python/blob/main/CHANGELOG.md"
-
-        [build-system]
-        requires = ["hatchling"]
-        build-backend = "hatchling.build"
-
-        # The distribution name (simple_module_{ctx.pkg}) doesn't match the package
-        # directory ({ctx.pkg}), so hatchling can't infer what to ship — without
-        # this the wheel builds empty and the entry point fails to import.
-        [tool.hatch.build.targets.wheel]
-        packages = ["{ctx.pkg}"]
-
-        # Ship the module-root package.json inside the wheel so the host can
-        # discover JS deps via importlib.resources after a pip install.
-        [tool.hatch.build.targets.wheel.force-include]
-        "package.json" = "{ctx.pkg}/package.json"
-
-        [tool.uv.sources]
-        simple_module_core = {{ workspace = true }}
-        simple_module_db = {{ workspace = true }}
-        simple_module_hosting = {{ workspace = true }}
-        """
-
-
-def package_init(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """{ctx.class_name} module."""
-        '''
-
-
-def locales_en_json(ctx: ScaffoldContext) -> str:
-    """Default English locale file for a scaffolded module.
-
-    Keys here must stay in sync with the strings emitted by
-    :func:`_templates_tsx.browse_tsx` / ``create_tsx`` / ``edit_tsx``.
-    """
-    return (
-        "{\n"
-        '  "browse": {\n'
-        f'    "title": "{ctx.class_name}",\n'
-        f'    "description": "Manage your {ctx.name}",\n'
-        f'    "new_button": "New {ctx.singular_class}",\n'
-        f'    "empty_title": "No {ctx.name} yet",\n'
-        f'    "empty_description": "Get started by creating your first {ctx.singular}.",\n'
-        '    "edit_link": "Edit"\n'
-        "  },\n"
-        '  "form": {\n'
-        '    "name_label": "Name",\n'
-        '    "description_label": "Description"\n'
-        "  },\n"
-        '  "create": {\n'
-        f'    "title": "New {ctx.singular_class}",\n'
-        f'    "submit_button": "Create"\n'
-        "  },\n"
-        '  "edit": {\n'
-        f'    "title": "Edit {ctx.singular_class}",\n'
-        '    "submit_button": "Save"\n'
-        "  }\n"
-        "}\n"
-    )
-
-
-def models_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """SQLModel tables for the {ctx.class_name} module."""
-
-        from __future__ import annotations
-
-        from simple_module_db.base import create_module_base
-        from simple_module_db.mixins import AuditMixin
-        from sqlmodel import Field
-
-        # All modules share the host's single schema, so __tablename__ is
-        # prefixed with the module name to avoid collisions.
-        Base = create_module_base("{ctx.name}")
-
-
-        class {ctx.singular_class}(Base, AuditMixin, table=True):  # ty: ignore[unsupported-base]
-            """A {ctx.singular} entity."""
-
-            __tablename__ = "{ctx.name}_{ctx.singular}"
-
-            id: int | None = Field(default=None, primary_key=True)
-            name: str = Field(max_length=200)
-            description: str | None = Field(default=None, max_length=2000)
-            is_active: bool = Field(default=True)
-        '''
-
-
-def service_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """{ctx.singular_class} service implementation."""
-
-        from __future__ import annotations
-
-        from sqlalchemy import select
-        from sqlalchemy.ext.asyncio import AsyncSession
-
-        from {ctx.pkg}.contracts.schemas import (
-            {ctx.singular_class}Create,
-            {ctx.singular_class}Out,
-            {ctx.singular_class}Update,
-        )
-        from {ctx.pkg}.models import {ctx.singular_class}
-
-
-        class {ctx.singular_class}Service:
-            """CRUD operations for {ctx.name}."""
-
-            def __init__(self, db: AsyncSession) -> None:
-                self.db = db
-
-            async def get_all(self) -> list[{ctx.singular_class}Out]:
-                result = await self.db.execute(
-                    select({ctx.singular_class})
-                    .where({ctx.singular_class}.is_active.is_(True))
-                    .order_by({ctx.singular_class}.id)
-                )
-                return [{ctx.singular_class}Out.model_validate(row) for row in result.scalars()]
-
-            async def get_by_id(self, {ctx.singular}_id: int) -> {ctx.singular_class}Out | None:
-                entity = await self.db.get({ctx.singular_class}, {ctx.singular}_id)
-                if entity is None:
-                    return None
-                return {ctx.singular_class}Out.model_validate(entity)
-
-            async def create(self, data: {ctx.singular_class}Create) -> {ctx.singular_class}Out:
-                entity = {ctx.singular_class}(**data.model_dump())
-                self.db.add(entity)
-                await self.db.flush()
-                await self.db.refresh(entity)
-                return {ctx.singular_class}Out.model_validate(entity)
-
-            async def update(
-                self, {ctx.singular}_id: int, data: {ctx.singular_class}Update
-            ) -> {ctx.singular_class}Out | None:
-                entity = await self.db.get({ctx.singular_class}, {ctx.singular}_id)
-                if entity is None:
-                    return None
-                for field, value in data.model_dump(exclude_unset=True).items():
-                    setattr(entity, field, value)
-                await self.db.flush()
-                await self.db.refresh(entity)
-                return {ctx.singular_class}Out.model_validate(entity)
-
-            async def delete(self, {ctx.singular}_id: int) -> bool:
-                entity = await self.db.get({ctx.singular_class}, {ctx.singular}_id)
-                if entity is None:
-                    return False
-                await self.db.delete(entity)
-                return True
-        '''
-
-
-def deps_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """FastAPI dependencies for the {ctx.class_name} module."""
-
-        from __future__ import annotations
-
-        from fastapi import Depends
-        from simple_module_db.deps import get_db
-        from sqlalchemy.ext.asyncio import AsyncSession
-
-        from {ctx.pkg}.service import {ctx.singular_class}Service
-
-
-        async def get_{ctx.singular}_service(
-            db: AsyncSession = Depends(get_db),
-        ) -> {ctx.singular_class}Service:
-            return {ctx.singular_class}Service(db)
-        '''
-
-
-def readme_md(ctx: ScaffoldContext) -> str:
-    """A README that satisfies scripts/check_readmes.py out of the box.
-
-    That checker requires an H1, an "Install" and a "Usage" section, and at
-    least 500 bytes — a scaffolded module used to fail `make lint` on all
-    three until an author wrote one by hand.
-    """
-    return f"""\
-        # simple_module_{ctx.pkg}
-
-        The {ctx.class_name} module for
-        [simple_module](https://github.com/antosubash/simple_module_python) apps.
-
-        Replace this paragraph with a description of what the module actually does —
-        the problem it solves and the surface it exposes to a host application.
-
-        ## Install
-
-        ```bash
-        pip install simple_module_{ctx.pkg}
-        ```
-
-        Add `simple_module_{ctx.pkg}` to your host's dependencies; the
-        `[project.entry-points.simple_module]` entry point is discovered automatically
-        at boot, so no further wiring is required.
-
-        ## Usage
-
-        | Route | Page | Purpose |
-        |---|---|---|
-        | `GET /{ctx.name}/` | `{ctx.class_name}/Browse` | List view |
-        | `GET /api/{ctx.name}/` | — | JSON list endpoint |
-
-        Both are gated by the `{ctx.name}.view` permission. Document the real routes,
-        settings (`SM_{ctx.name.upper()}_*`) and any events the module emits here.
-
-        ## Configuration
-
-        Settings live on `app.state.{ctx.pkg}` and use the `SM_{ctx.name.upper()}_*`
-        environment prefix.
-        """
-
-
-def license_txt(ctx: ScaffoldContext) -> str:
-    """MIT license — scripts/check_metadata.py requires license = "MIT"."""
-    return """\
-        MIT License
-
-        Permission is hereby granted, free of charge, to any person obtaining a copy
-        of this software and associated documentation files (the "Software"), to deal
-        in the Software without restriction, including without limitation the rights
-        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-        copies of the Software, and to permit persons to whom the Software is
-        furnished to do so, subject to the following conditions:
-
-        The above copyright notice and this permission notice shall be included in all
-        copies or substantial portions of the Software.
-
-        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-        SOFTWARE.
-        """
diff --git a/scripts/_templates_tests.py b/scripts/_templates_tests.py
deleted file mode 100644
index b8a009416..000000000
--- a/scripts/_templates_tests.py
+++ /dev/null
@@ -1,181 +0,0 @@
-"""Template generator for the scaffolded module's test file."""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def test_module_py(ctx: ScaffoldContext) -> str:
-    return f'''\
-        """Tests for the {ctx.class_name} module: service CRUD, API endpoints, schema validation."""
-
-        from __future__ import annotations
-
-        import httpx
-        import pytest
-        from pydantic import ValidationError
-        from {ctx.pkg}.contracts.schemas import (
-            {ctx.singular_class}Create,
-            {ctx.singular_class}Update,
-        )
-        from {ctx.pkg}.service import {ctx.singular_class}Service
-        from sqlalchemy.ext.asyncio import AsyncSession
-
-        # ── Schema validation ────────────────────────────────────────────────
-
-
-        class Test{ctx.singular_class}Schemas:
-            async def test_create_valid(self):
-                data = {ctx.singular_class}Create(name="Test {ctx.singular_class}")
-                assert data.name == "Test {ctx.singular_class}"
-                assert data.description is None
-
-            async def test_create_empty_name_rejected(self):
-                with pytest.raises(ValidationError):
-                    {ctx.singular_class}Create(name="")
-
-            async def test_update_all_optional(self):
-                data = {ctx.singular_class}Update()
-                assert data.name is None
-                assert data.is_active is None
-
-
-        # ── {ctx.singular_class}Service CRUD ──────────────────────────────────────────────
-
-
-        class Test{ctx.singular_class}Service:
-            async def test_create(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                item = await svc.create({ctx.singular_class}Create(name="Test"))
-                assert item.id is not None
-                assert item.name == "Test"
-                assert item.is_active is True
-
-            async def test_get_all(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                await svc.create({ctx.singular_class}Create(name="A"))
-                await svc.create({ctx.singular_class}Create(name="B"))
-                items = await svc.get_all()
-                assert len(items) == 2
-
-            async def test_get_by_id(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                created = await svc.create({ctx.singular_class}Create(name="X"))
-                found = await svc.get_by_id(created.id)
-                assert found is not None
-                assert found.name == "X"
-
-            async def test_get_by_id_not_found(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                found = await svc.get_by_id(999)
-                assert found is None
-
-            async def test_update(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                created = await svc.create({ctx.singular_class}Create(name="Old"))
-                updated = await svc.update(created.id, {ctx.singular_class}Update(name="New"))
-                assert updated is not None
-                assert updated.name == "New"
-
-            async def test_update_not_found(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                result = await svc.update(999, {ctx.singular_class}Update(name="Ghost"))
-                assert result is None
-
-            async def test_delete(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                created = await svc.create({ctx.singular_class}Create(name="Doomed"))
-                deleted = await svc.delete(created.id)
-                assert deleted is True
-
-            async def test_delete_not_found(self, db_session: AsyncSession):
-                svc = {ctx.singular_class}Service(db_session)
-                deleted = await svc.delete(999)
-                assert deleted is False
-
-
-        # ── API endpoints ───────────────────────────────────────────────
-
-
-        class Test{ctx.class_name}API:
-            async def test_list_empty(self, authenticated_client: httpx.AsyncClient):
-                resp = await authenticated_client.get("/api/{ctx.name}/")
-                assert resp.status_code == 200
-                assert resp.json() == []
-
-            async def test_create(self, authenticated_client: httpx.AsyncClient):
-                resp = await authenticated_client.post(
-                    "/api/{ctx.name}/",
-                    json={{"name": "Test {ctx.singular_class}"}},
-                )
-                assert resp.status_code == 201
-                data = resp.json()
-                assert data["name"] == "Test {ctx.singular_class}"
-                assert data["id"] is not None
-
-            async def test_get_by_id(self, authenticated_client: httpx.AsyncClient):
-                create_resp = await authenticated_client.post(
-                    "/api/{ctx.name}/",
-                    json={{"name": "Findable"}},
-                )
-                item_id = create_resp.json()["id"]
-                resp = await authenticated_client.get(f"/api/{ctx.name}/{{item_id}}")
-                assert resp.status_code == 200
-                assert resp.json()["name"] == "Findable"
-
-            async def test_get_not_found(self, authenticated_client: httpx.AsyncClient):
-                resp = await authenticated_client.get("/api/{ctx.name}/99999")
-                assert resp.status_code == 404
-
-            async def test_update(self, authenticated_client: httpx.AsyncClient):
-                create_resp = await authenticated_client.post(
-                    "/api/{ctx.name}/",
-                    json={{"name": "Original"}},
-                )
-                item_id = create_resp.json()["id"]
-                resp = await authenticated_client.put(
-                    f"/api/{ctx.name}/{{item_id}}",
-                    json={{"name": "Updated"}},
-                )
-                assert resp.status_code == 200
-                assert resp.json()["name"] == "Updated"
-
-            async def test_delete(self, authenticated_client: httpx.AsyncClient):
-                create_resp = await authenticated_client.post(
-                    "/api/{ctx.name}/",
-                    json={{"name": "Deletable"}},
-                )
-                item_id = create_resp.json()["id"]
-                resp = await authenticated_client.delete(f"/api/{ctx.name}/{{item_id}}")
-                assert resp.status_code == 204
-
-            async def test_delete_not_found(self, authenticated_client: httpx.AsyncClient):
-                resp = await authenticated_client.delete("/api/{ctx.name}/99999")
-                assert resp.status_code == 404
-
-            async def test_create_invalid_data(self, authenticated_client: httpx.AsyncClient):
-                resp = await authenticated_client.post(
-                    "/api/{ctx.name}/",
-                    json={{"name": ""}},
-                )
-                assert resp.status_code == 422
-
-
-        # ── Module lifecycle ────────────────────────────────────────────────
-
-
-        class Test{ctx.class_name}ModuleLifecycle:
-            async def test_on_startup_does_not_call_create_all(self):
-                """on_startup should not create tables — Alembic manages schema."""
-                from unittest.mock import AsyncMock, MagicMock
-
-                from {ctx.pkg}.module import {ctx.class_name}Module
-
-                mod = {ctx.class_name}Module()
-                mock_app = MagicMock()
-                mock_app.state.sm.db.engine = AsyncMock()
-
-                await mod.on_startup(mock_app)
-
-                mock_app.state.sm.db.engine.begin.assert_not_called()
-        '''
diff --git a/scripts/_templates_tsx.py b/scripts/_templates_tsx.py
deleted file mode 100644
index 1dcf3e9e2..000000000
--- a/scripts/_templates_tsx.py
+++ /dev/null
@@ -1,145 +0,0 @@
-"""Template generators for the three React/Inertia page TSX files."""
-
-from __future__ import annotations
-
-from _templates_py import ScaffoldContext
-
-
-def browse_tsx(ctx: ScaffoldContext) -> str:
-    return f"""\
-        import {{ keys, useT }} from '@simple-module-py/i18n';
-
-        type {ctx.singular_class} = {{
-          id: number;
-          name: string;
-          description: string | null;
-          is_active: boolean;
-        }};
-
-        type Props = {{ {ctx.name}: {ctx.singular_class}[] }};
-
-        export default function Browse({{ {ctx.name} }}: Props) {{
-          const {{ t }} = useT();
-          return (
-            <div className="p-6">
-              <div className="flex items-center justify-between mb-4">
-                <h1 className="text-2xl font-semibold">{{t(keys.{ctx.pkg}.browse.title)}}</h1>
-                <a
-                  href="/{ctx.name}/create"
-                  className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
-                >
-                  {{t(keys.{ctx.pkg}.browse.new_button)}}
-                </a>
-              </div>
-              {{{ctx.name}.length === 0 ? (
-                <div className="py-12 text-center">
-                  <h2 className="text-lg font-medium">{{t(keys.{ctx.pkg}.browse.empty_title)}}</h2>
-                  <p className="text-sm text-muted-foreground mt-1">
-                    {{t(keys.{ctx.pkg}.browse.empty_description)}}
-                  </p>
-                </div>
-              ) : (
-                <ul className="divide-y">
-                  {{{ctx.name}.map(({ctx.singular}) => (
-                    <li key={{{ctx.singular}.id}} className="py-2 flex justify-between">
-                      <span>{{{ctx.singular}.name}}</span>
-                      <a href={{`/{ctx.name}/${{{ctx.singular}.id}}/edit`}}>
-                        {{t(keys.{ctx.pkg}.browse.edit_link)}}
-                      </a>
-                    </li>
-                  ))}}
-                </ul>
-              )}}
-            </div>
-          );
-        }}
-        """
-
-
-def create_tsx(ctx: ScaffoldContext) -> str:
-    return f"""\
-        import {{ keys, useT }} from '@simple-module-py/i18n';
-
-        export default function Create() {{
-          const {{ t }} = useT();
-          return (
-            <div className="p-6 max-w-xl">
-              <h1 className="text-2xl font-semibold mb-4">{{t(keys.{ctx.pkg}.create.title)}}</h1>
-              <form method="post" action="/{ctx.name}" className="space-y-3">
-                <label className="block">
-                  <span className="block text-sm">{{t(keys.{ctx.pkg}.form.name_label)}}</span>
-                  <input name="name" required className="border rounded w-full p-2" />
-                </label>
-                <label className="block">
-                  <span className="block text-sm">
-                    {{t(keys.{ctx.pkg}.form.description_label)}}
-                  </span>
-                  <textarea name="description" className="border rounded w-full p-2" />
-                </label>
-                <button
-                  type="submit"
-                  className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
-                >
-                  {{t(keys.{ctx.pkg}.create.submit_button)}}
-                </button>
-              </form>
-            </div>
-          );
-        }}
-        """
-
-
-def edit_tsx(ctx: ScaffoldContext) -> str:
-    return f"""\
-        import {{ keys, useT }} from '@simple-module-py/i18n';
-
-        type {ctx.singular_class} = {{
-          id: number;
-          name: string;
-          description: string | null;
-          is_active: boolean;
-        }};
-
-        type Props = {{ {ctx.singular}: {ctx.singular_class} }};
-
-        export default function Edit({{ {ctx.singular} }}: Props) {{
-          const {{ t }} = useT();
-          return (
-            <div className="p-6 max-w-xl">
-              <h1 className="text-2xl font-semibold mb-4">{{t(keys.{ctx.pkg}.edit.title)}}</h1>
-              <form
-                method="post"
-                action={{`/{ctx.name}/${{{ctx.singular}.id}}`}}
-                className="space-y-3"
-              >
-                <input type="hidden" name="_method" value="put" />
-                <label className="block">
-                  <span className="block text-sm">{{t(keys.{ctx.pkg}.form.name_label)}}</span>
-                  <input
-                    name="name"
-                    defaultValue={{{ctx.singular}.name}}
-                    required
-                    className="border rounded w-full p-2"
-                  />
-                </label>
-                <label className="block">
-                  <span className="block text-sm">
-                    {{t(keys.{ctx.pkg}.form.description_label)}}
-                  </span>
-                  <textarea
-                    name="description"
-                    defaultValue={{{ctx.singular}.description ?? ""}}
-                    className="border rounded w-full p-2"
-                  />
-                </label>
-                <button
-                  type="submit"
-                  className="rounded bg-primary px-3 py-1.5 text-primary-foreground"
-                >
-                  {{t(keys.{ctx.pkg}.edit.submit_button)}}
-                </button>
-              </form>
-            </div>
-          );
-        }}
-        """
diff --git a/scripts/bump_version.py b/scripts/bump_version.py
index 9718c6284..4458530d6 100644
--- a/scripts/bump_version.py
+++ b/scripts/bump_version.py
@@ -66,6 +66,20 @@ def bump_python_package(pyproject: Path, new_version: str, *, check: bool = Fals
                     changed = True
                     deps[i] = want
 
+    # Extras (e.g. ``file_storage[tasks]``) pin lockstep siblings too; leaving
+    # them behind would make the published extra uninstallable after a bump.
+    extras = project.get("optional-dependencies")
+    if extras is not None:
+        for group in extras.values():
+            for i, entry in enumerate(group):
+                spec = str(entry)
+                name = _parse_requirement_name(spec)
+                if name.startswith(PY_PKG_PREFIX):
+                    want = f"{name}=={new_version}"
+                    if spec != want:
+                        changed = True
+                        group[i] = want
+
     if check:
         return not changed
     if changed:
diff --git a/scripts/new_module.py b/scripts/new_module.py
index d77b874c9..b87b4f5ef 100644
--- a/scripts/new_module.py
+++ b/scripts/new_module.py
@@ -1,249 +1,57 @@
 #!/usr/bin/env python3
-"""Scaffold a new module for the Simple Module Python framework.
+"""Scaffold a new module inside this repository.
 
 Usage:
-    python scripts/new_module.py <module_name>
     make new-module name=<module_name>
 
-Creates the full module directory structure under modules/<name>/ with all
-required files (pyproject.toml, module class, models, service, schemas,
-endpoints, tests) and registers the module in host/pyproject.toml and
-the root pyproject.toml.
+A thin wrapper: the files come from the same templates ``smpy create-module``
+uses (``simple_module_cli.scaffolding.create_module``, in-repo variant), then
+the module is wired into ``host/pyproject.toml`` and the root ``pyproject.toml``.
 """
 
 from __future__ import annotations
 
 import argparse
-import re
 import sys
-import textwrap
 from pathlib import Path
 
-from simple_module_cli.case import to_pascal_case
-
-# Make sibling template modules importable when this file is run as a script.
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-
-from _templates_contracts import contracts_init, schemas_py
-from _templates_endpoints import api_py, views_py
-from _templates_js import package_json, tsconfig_json
-from _templates_module import module_py, services_py, settings_py
-from _templates_py import (
-    ScaffoldContext,
-    deps_py,
-    license_txt,
-    locales_en_json,
-    models_py,
-    package_init,
-    pyproject_toml,
-    readme_md,
-    service_py,
-)
-from _templates_tests import test_module_py
-from _templates_tsx import browse_tsx, create_tsx, edit_tsx
+from simple_module_cli.case import InvalidScaffoldNameError, validate_scaffold_name
+from simple_module_cli.framework_repo import wire_module
+from simple_module_cli.pins import resolve_framework_version
+from simple_module_cli.scaffolding import create_module
 
 ROOT = Path(__file__).resolve().parent.parent
 
 
-def validate_name(name: str) -> str:
-    """Validate module name: lowercase, alphanumeric, underscores allowed."""
-    if not re.match(r"^[a-z][a-z0-9_]*$", name):
-        print(
-            f"Error: Module name '{name}' is invalid. "
-            "Use lowercase letters, digits, and underscores. Must start with a letter.",
-            file=sys.stderr,
-        )
-        sys.exit(1)
-    return name
-
-
-def to_singular(name: str) -> str:
-    """Naive singularization: strip trailing 's' if present."""
-    if name.endswith("s") and not name.endswith("ss"):
-        return name[:-1]
-    return name
-
-
-def create_file(path: Path, content: str) -> None:
-    """Create a file with the given content, creating parent dirs as needed."""
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(textwrap.dedent(content).lstrip("\n"))
-    print(f"  created {path.relative_to(ROOT)}")
-
-
-def _build_context(name: str) -> ScaffoldContext:
-    singular = to_singular(name)
-    return ScaffoldContext(
-        name=name,
-        class_name=to_pascal_case(name),
-        singular=singular,
-        singular_class=to_pascal_case(singular),
-        pkg=name,
-    )
-
-
-def scaffold_module(name: str) -> None:
-    """Generate all files for a new module."""
-    module_dir = ROOT / "modules" / name
-    if module_dir.exists():
-        print(f"Error: Module directory modules/{name}/ already exists.", file=sys.stderr)
-        sys.exit(1)
-
-    ctx = _build_context(name)
-    src_dir = module_dir / ctx.pkg
-
-    print(f"Scaffolding module '{name}'...")
-
-    create_file(module_dir / "pyproject.toml", pyproject_toml(ctx))
-    create_file(module_dir / "README.md", readme_md(ctx))
-    create_file(module_dir / "LICENSE", license_txt(ctx))
-    create_file(module_dir / "package.json", package_json(ctx))
-    create_file(module_dir / "tsconfig.json", tsconfig_json(ctx))
-    create_file(src_dir / "__init__.py", package_init(ctx))
-    create_file(src_dir / "py.typed", "")
-    create_file(src_dir / "module.py", module_py(ctx))
-    create_file(src_dir / "settings.py", settings_py(ctx))
-    create_file(src_dir / "services.py", services_py(ctx))
-    create_file(src_dir / "models.py", models_py(ctx))
-    create_file(src_dir / "contracts" / "__init__.py", contracts_init(ctx))
-    create_file(src_dir / "contracts" / "schemas.py", schemas_py(ctx))
-    create_file(src_dir / "service.py", service_py(ctx))
-    create_file(src_dir / "deps.py", deps_py(ctx))
-    create_file(src_dir / "endpoints" / "__init__.py", "")
-    create_file(src_dir / "endpoints" / "api.py", api_py(ctx))
-    create_file(src_dir / "endpoints" / "views.py", views_py(ctx))
-    create_file(src_dir / "pages" / "Browse.tsx", browse_tsx(ctx))
-    create_file(src_dir / "pages" / "Create.tsx", create_tsx(ctx))
-    create_file(src_dir / "pages" / "Edit.tsx", edit_tsx(ctx))
-    create_file(src_dir / "locales" / "en.json", locales_en_json(ctx))
-    create_file(module_dir / "tests" / f"test_{name}.py", test_module_py(ctx))
-
-
-def _insert_after_last_match(content: str, pattern: str, line_to_insert: str) -> str | None:
-    """Insert ``line_to_insert`` on a new line after the last line matching ``pattern``.
-
-    Returns the modified content, or None if no line matched.
-    """
-    matches = list(re.finditer(pattern, content, re.MULTILINE))
-    if not matches:
-        return None
-    last = matches[-1]
-    end_of_line = content.find("\n", last.end())
-    if end_of_line == -1:
-        end_of_line = len(content)
-    return content[: end_of_line + 1] + line_to_insert + content[end_of_line + 1 :]
-
-
-def update_host_pyproject(name: str) -> None:
-    """Add the new module as a dependency in host/pyproject.toml."""
-    host_toml = ROOT / "host" / "pyproject.toml"
-    content = host_toml.read_text()
-    # Must match the distribution name the module's own pyproject.toml declares
-    # (``simple_module_<name>``, see _templates_py.pyproject_toml). Writing the
-    # bare module name here produces a dependency uv cannot resolve to the
-    # workspace member, and `uv sync` fails with "not a workspace member".
-    pkg = f"simple_module_{name}"
-
-    if f'"{pkg}"' in content:
-        print(f"  host/pyproject.toml already contains {pkg}, skipping")
-        return
-
-    original = content
-
-    # Add to [project] dependencies — insert after last module dep line
-    result = _insert_after_last_match(
-        content,
-        r'^    "[\w-]+",\s*$',
-        f'    "{pkg}",\n',
-    )
-    if result:
-        content = result
-
-    # Add to [tool.uv.sources] — insert after last workspace source line
-    result = _insert_after_last_match(
-        content,
-        r"^[\w-]+ = \{ workspace = true \}\s*$",
-        f"{pkg} = {{ workspace = true }}\n",
-    )
-    if result:
-        content = result
-
-    if content == original:
-        print(
-            f"  warning: could not find insertion point in host/pyproject.toml for {pkg}",
-            file=sys.stderr,
-        )
-        return
-
-    host_toml.write_text(content)
-    print(f"  updated host/pyproject.toml (added {pkg})")
-
-
-def update_root_pyproject(name: str) -> None:
-    """Add the module to type-checking paths and test paths in root pyproject.toml."""
-    root_toml = ROOT / "pyproject.toml"
-    content = root_toml.read_text()
-    src_path = f"modules/{name}"
-    test_path = f"modules/{name}/tests"
-
-    if f'"{src_path}",' in content and f'"{test_path}"' in content:
-        print(f"  root pyproject.toml already contains modules/{name}, skipping")
-        return
-
-    original = content
-
-    # Add to [tool.ty.environment] extra-paths — insert after last "modules/*" entry
-    result = _insert_after_last_match(
-        content,
-        r'^    "modules/[\w/]+",\s*$',
-        f'    "{src_path}",\n',
-    )
-    if result:
-        content = result
-
-    # Append after the last "modules/*/tests" entry, before the closing ]
-    testpath_matches = list(re.finditer(r'"modules/[\w/]+/tests"', content))
-    if testpath_matches and f'"{test_path}"' not in content:
-        last = testpath_matches[-1]
-        content = content[: last.end()] + f', "{test_path}"' + content[last.end() :]
-
-    if content == original:
-        print(
-            "  warning: could not find insertion point in pyproject.toml",
-            file=sys.stderr,
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Scaffold a new module in this repository")
+    parser.add_argument("name", help="Module name in snake_case (e.g. 'orders', 'blog_posts')")
+    name = parser.parse_args().name
+
+    try:
+        validate_scaffold_name(name)
+        if "-" in name:
+            raise InvalidScaffoldNameError(f"{name!r}: use underscores, not hyphens")
+        create_module(
+            ROOT / "modules" / name,
+            name=name,
+            framework_version=resolve_framework_version(),
+            framework_repo=True,
         )
-        return
-
-    root_toml.write_text(content)
-    print("  updated pyproject.toml (added type-check path + test path)")
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(
-        description="Scaffold a new module for Simple Module Python",
-    )
-    parser.add_argument(
-        "name",
-        help="Module name in snake_case (e.g. 'orders', 'blog_posts')",
+    except (InvalidScaffoldNameError, FileExistsError) as exc:
+        print(f"Error: {exc}", file=sys.stderr)
+        return 1
+
+    wire_module(ROOT, name)
+    print(f"\nModule '{name}' scaffolded under modules/{name}/.")
+    print(
+        "Next: edit models.py, then autogenerate (`make migration` hits Multiple heads):\n"
+        "  uv run --project host alembic -c host/alembic.ini revision --autogenerate "
+        '-m "<msg>" --head <branch_label>@head\n'
+        "Set branch_labels on the module's first migration."
     )
-    args = parser.parse_args()
-
-    name = validate_name(args.name)
-
-    scaffold_module(name)
-    update_host_pyproject(name)
-    update_root_pyproject(name)
-
-    print()
-    print(f"Module '{name}' scaffolded successfully!")
-    print()
-    print("Next steps:")
-    print("  1. Run 'uv sync --all-packages && npm install' to install the new module")
-    print(f"  2. Edit modules/{name}/{name}/models.py to define your domain model")
-    print("  3. Update schemas, service, and endpoints to match your model")
-    print(f"  4. Run 'make migration msg=\"add {name} tables\"' to create a migration")
-    print("  5. Run 'make test' to verify everything works")
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())
diff --git a/scripts/tests/conftest.py b/scripts/tests/conftest.py
index 0cbc7fc7e..7a7852450 100644
--- a/scripts/tests/conftest.py
+++ b/scripts/tests/conftest.py
@@ -1,55 +1,11 @@
-"""Shared fixtures and constants for new_module scaffolding tests."""
+"""Shared fixtures for the release-scripts test suite (check_metadata, check_readmes)."""
 
 from __future__ import annotations
 
-import sys
 from pathlib import Path
 
 import pytest
 
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-import new_module
-from new_module import scaffold_module
-
-MINIMAL_HOST_PYPROJECT = (
-    '[project]\ndependencies = [\n    "products",\n]\n\n'
-    "[tool.uv.sources]\nproducts = { workspace = true }\n"
-)
-MINIMAL_ROOT_PYPROJECT = (
-    '[tool.ty.environment]\nextra-paths = [\n    "modules/products",\n]\n\n'
-    '[tool.pytest.ini_options]\ntestpaths = ["modules/products/tests"]\n'
-)
-
-
-@pytest.fixture
-def module_root(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
-    """Provide a temp directory patched as the script's ROOT with modules/ pre-created."""
-    monkeypatch.setattr(new_module, "ROOT", tmp_path)
-    (tmp_path / "modules").mkdir()
-    return tmp_path
-
-
-@pytest.fixture
-def workspace(module_root: Path) -> Path:
-    """module_root plus host/ and root pyproject.toml ready for end-to-end runs."""
-    (module_root / "host").mkdir()
-    (module_root / "host" / "pyproject.toml").write_text(MINIMAL_HOST_PYPROJECT)
-    (module_root / "pyproject.toml").write_text(MINIMAL_ROOT_PYPROJECT)
-    return module_root
-
-
-@pytest.fixture
-def scaffolded_orders(module_root: Path) -> Path:
-    """Run the scaffold once and return the orders source directory."""
-    scaffold_module("orders")
-    return module_root / "modules" / "orders" / "orders"
-
-
-# ---------------------------------------------------------------------------
-# Fixtures for the release-scripts test suite (check_metadata, check_readmes).
-# ---------------------------------------------------------------------------
-
 
 @pytest.fixture
 def tmp_pkg_dir(tmp_path: Path) -> Path:
diff --git a/scripts/tests/test_bump_version.py b/scripts/tests/test_bump_version.py
index a4d80c24c..f842da586 100644
--- a/scripts/tests/test_bump_version.py
+++ b/scripts/tests/test_bump_version.py
@@ -54,6 +54,20 @@ def test_python_bump_handles_unpinned_simple_module_dep(tmp_pkg_dir: Path, write
     assert '"simple_module_core==0.0.2"' in text
 
 
+def test_python_bump_rewrites_optional_dependency_pins(tmp_pkg_dir: Path, writer) -> None:
+    p = writer(
+        tmp_pkg_dir / "pyproject.toml",
+        '[project]\nname = "x"\nversion = "0.0.1"\n'
+        "[project.optional-dependencies]\n"
+        'tasks = ["simple_module_background_tasks==0.0.1", "celery>=5"]\n',
+    )
+    bump_python_package(p, "0.0.2")
+    text = p.read_text()
+    assert '"simple_module_background_tasks==0.0.2"' in text
+    assert '"celery>=5"' in text
+    assert bump_python_package(p, "0.0.2", check=True)
+
+
 # -------- npm --------
 
 NPM_SAMPLE = {
diff --git a/scripts/tests/test_cli.py b/scripts/tests/test_cli.py
deleted file mode 100644
index de5868f8b..000000000
--- a/scripts/tests/test_cli.py
+++ /dev/null
@@ -1,29 +0,0 @@
-"""Tests for the main() CLI entry point of the new_module script."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-import pytest
-from new_module import main
-
-
-class TestMainCLI:
-    """Tests for the main() entry point."""
-
-    def test_main_invokes_full_pipeline(
-        self, workspace: Path, monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture
-    ):
-        monkeypatch.setattr(sys, "argv", ["new_module.py", "orders"])
-        main()
-
-        assert (workspace / "modules" / "orders" / "pyproject.toml").exists()
-        assert (workspace / "modules" / "orders" / "orders" / "module.py").exists()
-        assert '"simple_module_orders"' in (workspace / "host" / "pyproject.toml").read_text()
-        assert "Scaffolding module 'orders'" in capsys.readouterr().out
-
-    def test_main_exits_on_invalid_name(self, monkeypatch: pytest.MonkeyPatch):
-        monkeypatch.setattr(sys, "argv", ["new_module.py", "Invalid-Name"])
-        with pytest.raises(SystemExit):
-            main()
diff --git a/scripts/tests/test_generated.py b/scripts/tests/test_generated.py
deleted file mode 100644
index 531bc1652..000000000
--- a/scripts/tests/test_generated.py
+++ /dev/null
@@ -1,145 +0,0 @@
-"""Tests verifying the content and validity of files generated by scaffold_module."""
-
-from __future__ import annotations
-
-import ast
-import tomllib
-from pathlib import Path
-
-import pytest
-from new_module import scaffold_module
-
-
-class TestGeneratedFilesSyntaxValidity:
-    """Ensure every generated Python file is syntactically valid and TOML is parseable."""
-
-    def test_all_python_files_parse(self, scaffolded_orders: Path):
-        py_files = list(scaffolded_orders.parent.rglob("*.py"))
-        assert len(py_files) > 0
-
-        for py_file in py_files:
-            try:
-                ast.parse(py_file.read_text(), filename=str(py_file))
-            except SyntaxError as e:
-                pytest.fail(f"Generated file {py_file.name} has syntax error: {e}")
-
-    def test_pyproject_toml_parses(self, scaffolded_orders: Path):
-        data = tomllib.loads((scaffolded_orders.parent / "pyproject.toml").read_text())
-
-        assert data["project"]["name"] == "simple_module_orders"
-        assert (
-            data["project"]["entry-points"]["simple_module"]["orders"]
-            == "orders.module:OrdersModule"
-        )
-
-    def test_compound_name_pyproject_toml_parses(self, module_root: Path):
-        scaffold_module("blog_posts")
-
-        pyproject = module_root / "modules" / "blog_posts" / "pyproject.toml"
-        data = tomllib.loads(pyproject.read_text())
-
-        assert data["project"]["name"] == "simple_module_blog_posts"
-        ep = data["project"]["entry-points"]["simple_module"]
-        assert ep["blog_posts"] == "blog_posts.module:BlogPostsModule"
-
-
-class TestGeneratedTemplateContent:
-    """Verify key fragments of generated templates."""
-
-    def test_service_has_full_crud(self, scaffolded_orders: Path):
-        service = (scaffolded_orders / "service.py").read_text()
-        assert "class OrderService:" in service
-        assert "async def get_all(self)" in service
-        assert "async def get_by_id(self" in service
-        assert "async def create(self" in service
-        assert "async def update(" in service
-        assert "async def delete(self" in service
-
-    def test_api_has_full_crud_endpoints(self, scaffolded_orders: Path):
-        api = (scaffolded_orders / "endpoints" / "api.py").read_text()
-        assert '@router.get("/"' in api
-        assert '@router.get("/{order_id}"' in api
-        assert '@router.post("/"' in api
-        assert '@router.put("/{order_id}"' in api
-        assert '@router.delete("/{order_id}"' in api
-        assert "status_code=201" in api
-        assert "status_code=204" in api
-
-    def test_views_use_inertia(self, scaffolded_orders: Path):
-        views = (scaffolded_orders / "endpoints" / "views.py").read_text()
-        assert "InertiaResponse" in views
-        assert "InertiaDep" in views
-        assert '"Orders/Browse"' in views
-        assert '"Orders/Create"' in views
-        assert '"Orders/Edit"' in views
-
-    def test_deps_provides_di_function(self, scaffolded_orders: Path):
-        deps = (scaffolded_orders / "deps.py").read_text()
-        assert "async def get_order_service(" in deps
-        assert "Depends(get_db)" in deps
-
-    def test_contracts_init_exports_public_api(self, scaffolded_orders: Path):
-        init = (scaffolded_orders / "contracts" / "__init__.py").read_text()
-        assert '"OrderCreate"' in init
-        assert '"OrderOut"' in init
-        assert '"OrderUpdate"' in init
-
-    def test_module_class_registers_routes(self, scaffolded_orders: Path):
-        module_py = (scaffolded_orders / "module.py").read_text()
-        assert "def register_routes(" in module_py
-        assert "api_router.include_router(api)" in module_py
-        assert "view_router.include_router(views)" in module_py
-
-    def test_module_class_registers_permissions(self, scaffolded_orders: Path):
-        module_py = (scaffolded_orders / "module.py").read_text()
-        assert '"orders.view"' in module_py
-        assert '"orders.create"' in module_py
-        assert '"orders.edit"' in module_py
-        assert '"orders.delete"' in module_py
-
-    def test_model_has_audit_mixin(self, scaffolded_orders: Path):
-        model = (scaffolded_orders / "models.py").read_text()
-        assert "from simple_module_db.mixins import AuditMixin" in model
-        assert "class Order(Base, AuditMixin, table=True):" in model
-        assert '__tablename__ = "orders_order"' in model
-
-    def test_test_file_has_test_classes(self, scaffolded_orders: Path):
-        test_file = (scaffolded_orders.parent / "tests" / "test_orders.py").read_text()
-        assert "class TestOrderSchemas:" in test_file
-        assert "class TestOrderService:" in test_file
-        assert "class TestOrdersAPI:" in test_file
-        assert "class TestOrdersModuleLifecycle:" in test_file
-
-    def test_module_py_registers_locale_dirs(self, scaffolded_orders: Path):
-        """Scaffolded module.py must expose locale_dirs() pointing at locales/."""
-        module_py = (scaffolded_orders / "module.py").read_text()
-        assert "import importlib.resources" in module_py
-        assert "def locale_dirs(self)" in module_py
-        assert '"orders"' in module_py
-        assert '"locales"' in module_py
-
-    def test_locales_en_json_exists_and_parses(self, scaffolded_orders: Path):
-        """Scaffolded modules ship a starter en.json with valid JSON."""
-        import json
-
-        locale_file = scaffolded_orders / "locales" / "en.json"
-        assert locale_file.exists()
-        data = json.loads(locale_file.read_text())
-        # Keys must match what the scaffolded pages call t() with.
-        assert data["browse"]["title"] == "Orders"
-        assert data["browse"]["new_button"] == "New Order"
-        assert data["create"]["submit_button"] == "Create"
-        assert data["edit"]["submit_button"] == "Save"
-        assert "name_label" in data["form"]
-        assert "description_label" in data["form"]
-
-    def test_pages_use_use_t_hook(self, scaffolded_orders: Path):
-        """Scaffolded Browse/Create/Edit pages must import keys + useT and use typed keys."""
-        for page in ("Browse.tsx", "Create.tsx", "Edit.tsx"):
-            content = (scaffolded_orders / "pages" / page).read_text()
-            assert "from '@simple-module-py/i18n'" in content, f"{page} missing i18n import"
-            assert "keys" in content and "useT" in content, f"{page} missing keys/useT import"
-            assert "const { t } = useT();" in content, f"{page} does not call useT()"
-            # Typed-key calls use property access, not string literals.
-            assert "t(keys.orders." in content, f"{page} does not invoke t(keys.orders.*)"
-            assert "t('orders." not in content, f"{page} still uses string-literal t('orders.*')"
diff --git a/scripts/tests/test_helpers.py b/scripts/tests/test_helpers.py
deleted file mode 100644
index 447540889..000000000
--- a/scripts/tests/test_helpers.py
+++ /dev/null
@@ -1,111 +0,0 @@
-"""Tests for pure helper functions in the new_module scaffolding script."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-from new_module import (
-    _insert_after_last_match,
-    create_file,
-    to_singular,
-    validate_name,
-)
-from simple_module_cli.case import to_pascal_case
-
-
-class TestValidateName:
-    def test_valid_simple_name(self):
-        assert validate_name("orders") == "orders"
-
-    def test_valid_name_with_underscore(self):
-        assert validate_name("blog_posts") == "blog_posts"
-
-    def test_valid_name_with_digits(self):
-        assert validate_name("v2_items") == "v2_items"
-
-    def test_rejects_uppercase(self):
-        with pytest.raises(SystemExit):
-            validate_name("Orders")
-
-    def test_rejects_hyphens(self):
-        with pytest.raises(SystemExit):
-            validate_name("blog-posts")
-
-    def test_rejects_starting_with_digit(self):
-        with pytest.raises(SystemExit):
-            validate_name("2fast")
-
-    def test_rejects_empty(self):
-        with pytest.raises(SystemExit):
-            validate_name("")
-
-
-class TestToPascalCase:
-    def test_single_word(self):
-        assert to_pascal_case("orders") == "Orders"
-
-    def test_two_words(self):
-        assert to_pascal_case("blog_posts") == "BlogPosts"
-
-    def test_three_words(self):
-        assert to_pascal_case("user_role_assignments") == "UserRoleAssignments"
-
-
-class TestToSingular:
-    def test_plural(self):
-        assert to_singular("orders") == "order"
-
-    def test_already_singular(self):
-        assert to_singular("inventory") == "inventory"
-
-    def test_double_s(self):
-        assert to_singular("access") == "access"
-
-    def test_plural_compound(self):
-        assert to_singular("blog_posts") == "blog_post"
-
-
-class TestInsertAfterLastMatch:
-    def test_inserts_after_last_matching_line(self):
-        content = 'dependencies = [\n    "foo",\n    "bar",\n    "baz",\n]\n'
-        result = _insert_after_last_match(content, r'^    "[\w]+",\s*$', '    "qux",\n')
-        assert result is not None
-        assert '"baz",\n    "qux",\n]' in result
-
-    def test_returns_none_when_no_match(self):
-        result = _insert_after_last_match("no matches\n", r"^XYZ$", "inserted\n")
-        assert result is None
-
-    def test_respects_last_of_many(self):
-        # `other = x` between matches must not divert insertion to before it
-        content = "sm-a = 1\nsm-b = 2\nother = x\nsm-c = 3\n"
-        result = _insert_after_last_match(content, r"^sm-\w+ = \d+$", "sm-d = 4\n")
-        assert result is not None
-        assert result.endswith("sm-c = 3\nsm-d = 4\n")
-
-    def test_inserts_before_trailing_content(self):
-        content = "a = 1\nb = 2\n# trailer\n"
-        result = _insert_after_last_match(content, r"^b = 2$", "c = 3\n")
-        assert result == "a = 1\nb = 2\nc = 3\n# trailer\n"
-
-
-class TestCreateFile:
-    def test_creates_file_with_content(self, module_root: Path):
-        target = module_root / "foo" / "bar.txt"
-        create_file(target, "hello world\n")
-
-        assert target.read_text() == "hello world\n"
-
-    def test_creates_parent_directories(self, module_root: Path):
-        target = module_root / "a" / "b" / "c" / "file.txt"
-        create_file(target, "")
-
-        assert target.exists()
-        assert target.parent.is_dir()
-
-    def test_dedents_content(self, module_root: Path):
-        target = module_root / "indented.txt"
-        create_file(target, "        line one\n        line two\n")
-
-        assert target.read_text() == "line one\nline two\n"
diff --git a/scripts/tests/test_scaffold.py b/scripts/tests/test_scaffold.py
deleted file mode 100644
index 7d0397451..000000000
--- a/scripts/tests/test_scaffold.py
+++ /dev/null
@@ -1,236 +0,0 @@
-"""Tests for scaffold_module and pyproject updates in new_module."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import pytest
-from new_module import scaffold_module, update_host_pyproject, update_root_pyproject
-
-MINIMAL_HOST_PYPROJECT = (
-    '[project]\ndependencies = [\n    "products",\n]\n\n'
-    "[tool.uv.sources]\nproducts = { workspace = true }\n"
-)
-MINIMAL_ROOT_PYPROJECT = (
-    '[tool.ty.environment]\nextra-paths = [\n    "modules/products",\n]\n\n'
-    '[tool.pytest.ini_options]\ntestpaths = ["modules/products/tests"]\n'
-)
-
-
-class TestScaffoldModule:
-    """Integration tests that run the scaffolding and verify output files."""
-
-    def test_scaffold_creates_all_files(self, scaffolded_orders: Path):
-        mod_dir = scaffolded_orders.parent
-        src_dir = scaffolded_orders
-
-        expected_files = [
-            mod_dir / "pyproject.toml",
-            src_dir / "__init__.py",
-            src_dir / "py.typed",
-            src_dir / "module.py",
-            # module.py's register_settings imports both of these; without them
-            # a freshly scaffolded module raises ModuleNotFoundError at boot.
-            src_dir / "settings.py",
-            src_dir / "services.py",
-            src_dir / "models.py",
-            src_dir / "service.py",
-            src_dir / "deps.py",
-            src_dir / "contracts" / "__init__.py",
-            src_dir / "contracts" / "schemas.py",
-            src_dir / "endpoints" / "__init__.py",
-            src_dir / "endpoints" / "api.py",
-            src_dir / "endpoints" / "views.py",
-            mod_dir / "tests" / "test_orders.py",
-        ]
-        for f in expected_files:
-            assert f.exists(), f"Missing: {f}"
-
-    def test_scaffold_pyproject_has_entry_point(self, scaffolded_orders: Path):
-        content = (scaffolded_orders.parent / "pyproject.toml").read_text()
-        assert 'orders = "orders.module:OrdersModule"' in content
-
-    def test_scaffold_pyproject_declares_the_wheel_package(self, scaffolded_orders: Path):
-        """The dist name (simple_module_orders) differs from the package dir
-        (orders), so hatchling cannot infer it — without an explicit declaration
-        the wheel builds empty and the entry point fails to import."""
-        content = (scaffolded_orders.parent / "pyproject.toml").read_text()
-        assert "[tool.hatch.build.targets.wheel]" in content
-        assert 'packages = ["orders"]' in content
-
-    def test_scaffold_settings_class_matches_the_module_import(self, scaffolded_orders: Path):
-        """module.py and services.py both import OrdersSettings by name."""
-        content = (scaffolded_orders / "settings.py").read_text()
-        assert "class OrdersSettings(DbBackedSettings):" in content
-
-    def test_scaffold_registers_settings_through_the_framework(self, scaffolded_orders: Path):
-        """register_settings goes through register_module_settings (#500), so the
-        host hydrates the class from the DB; a bare app.state assignment would not."""
-        content = (scaffolded_orders / "module.py").read_text()
-        assert "from simple_module_core.module_settings import register_module_settings" in content
-        assert "register_module_settings(" in content
-        assert "app.state.orders =" not in content
-
-    def test_scaffold_module_class_name(self, scaffolded_orders: Path):
-        content = (scaffolded_orders / "module.py").read_text()
-        assert "class OrdersModule(ModuleBase):" in content
-        assert 'name="Orders"' in content
-
-    def test_scaffold_model_is_singular(self, scaffolded_orders: Path):
-        content = (scaffolded_orders / "models.py").read_text()
-        assert "class Order(Base, AuditMixin, table=True):" in content
-
-    def test_scaffold_views_import_the_real_inertia_package(self, scaffolded_orders: Path):
-        """``inertia`` is not a package here; the adapter is ``simple_module_inertia``."""
-        content = (scaffolded_orders / "endpoints" / "views.py").read_text()
-        assert "from simple_module_inertia import InertiaResponse" in content
-        assert "from inertia import" not in content
-
-    def test_scaffold_js_config_matches_the_workspace(self, scaffolded_orders: Path):
-        """Inertia v3 peer range, and no ``baseUrl`` (deprecated; paths resolve
-        relative to the tsconfig) so the scaffold passes ``make lint``."""
-        mod_dir = scaffolded_orders.parent
-        assert '"@inertiajs/react": "^3.7.0"' in (mod_dir / "package.json").read_text()
-        assert "baseUrl" not in (mod_dir / "tsconfig.json").read_text()
-
-    def test_scaffold_rejects_duplicate(self, module_root: Path):
-        (module_root / "modules" / "orders").mkdir()
-
-        with pytest.raises(SystemExit):
-            scaffold_module("orders")
-
-    def test_scaffold_compound_name(self, module_root: Path):
-        scaffold_module("blog_posts")
-
-        src_dir = module_root / "modules" / "blog_posts" / "blog_posts"
-        assert (src_dir / "module.py").exists()
-
-        module_content = (src_dir / "module.py").read_text()
-        assert "class BlogPostsModule(ModuleBase):" in module_content
-
-        model_content = (src_dir / "models.py").read_text()
-        assert "class BlogPost(Base, AuditMixin, table=True):" in model_content
-
-        schema_content = (src_dir / "contracts" / "schemas.py").read_text()
-        assert "class BlogPostOut(SQLModel):" in schema_content
-        assert "class BlogPostCreate(SQLModel):" in schema_content
-        assert "class BlogPostUpdate(SQLModel):" in schema_content
-
-
-class TestUpdateHostPyproject:
-    def test_adds_module_dependency(self, module_root: Path):
-        host_dir = module_root / "host"
-        host_dir.mkdir()
-        (host_dir / "pyproject.toml").write_text(MINIMAL_HOST_PYPROJECT)
-
-        update_host_pyproject("orders")
-
-        # Must be the distribution name the module's own pyproject.toml declares,
-        # not the bare module name — uv resolves the workspace member by dist name.
-        content = (host_dir / "pyproject.toml").read_text()
-        assert '"simple_module_orders"' in content
-        assert "simple_module_orders = { workspace = true }" in content
-
-    def test_skips_if_already_present(self, module_root: Path):
-        host_dir = module_root / "host"
-        host_dir.mkdir()
-        original = (
-            '[project]\nname = "simple-module-host"\ndependencies = [\n'
-            '    "products",\n    "simple_module_orders",\n]\n\n[tool.uv.sources]\n'
-            "products = { workspace = true }\nsimple_module_orders = { workspace = true }\n"
-        )
-        (host_dir / "pyproject.toml").write_text(original)
-
-        update_host_pyproject("orders")
-
-        assert (host_dir / "pyproject.toml").read_text() == original
-
-
-class TestUpdateRootPyproject:
-    def test_adds_paths(self, module_root: Path):
-        (module_root / "pyproject.toml").write_text(MINIMAL_ROOT_PYPROJECT)
-
-        update_root_pyproject("orders")
-
-        content = (module_root / "pyproject.toml").read_text()
-        assert '"modules/orders"' in content
-        assert '"modules/orders/tests"' in content
-
-    def test_adds_paths_with_multiple_existing_modules(self, module_root: Path):
-        # Regression: matches the real repo layout where "host" comes after modules/*
-        (module_root / "pyproject.toml").write_text(
-            "[tool.ty.environment]\nextra-paths = [\n"
-            '    "framework/core",\n'
-            '    "framework/db",\n'
-            '    "framework/hosting",\n'
-            '    "modules/auth",\n'
-            '    "modules/dashboard",\n'
-            '    "modules/products",\n'
-            '    "host",\n]\n\n'
-            "[tool.pytest.ini_options]\n"
-            "testpaths = ["
-            '"framework/core/tests", '
-            '"modules/auth/tests", '
-            '"modules/products/tests"]\n'
-        )
-
-        update_root_pyproject("orders")
-
-        content = (module_root / "pyproject.toml").read_text()
-        # Insertion point must be after last modules/* entry, not after "host"
-        assert '"modules/orders",\n    "host"' in content
-        assert '"modules/products/tests", "modules/orders/tests"' in content
-
-    def test_skips_if_already_present(self, module_root: Path):
-        original = (
-            "[tool.ty.environment]\nextra-paths = [\n"
-            '    "modules/products",\n    "modules/orders",\n]\n\n'
-            "[tool.pytest.ini_options]\n"
-            'testpaths = ["modules/products/tests", "modules/orders/tests"]\n'
-        )
-        (module_root / "pyproject.toml").write_text(original)
-
-        update_root_pyproject("orders")
-
-        assert (module_root / "pyproject.toml").read_text() == original
-
-    def test_warns_when_no_insertion_point(self, module_root: Path, capsys: pytest.CaptureFixture):
-        (module_root / "pyproject.toml").write_text(
-            '[tool.ty.environment]\nextra-paths = ["host"]\n'
-            "[tool.pytest.ini_options]\ntestpaths = []\n"
-        )
-
-        update_root_pyproject("orders")
-
-        assert "warning" in capsys.readouterr().err.lower()
-
-
-class TestScaffoldPassesRepoChecks:
-    """A freshly scaffolded module must satisfy `make lint` immediately.
-
-    Before this, `make new-module` emitted no README and no license/keywords/
-    urls metadata, so check_readmes.py and check_metadata.py failed on every
-    new module until an author wrote them by hand.
-    """
-
-    def test_readme_is_created_and_satisfies_check_readmes(self, scaffolded_orders: Path):
-        readme = scaffolded_orders.parent / "README.md"
-        assert readme.exists(), "no README.md generated"
-        text = readme.read_text()
-        # Mirrors scripts/check_readmes.py: >=500 bytes, an H1, Install + Usage.
-        assert len(text.encode()) >= 500
-        assert text.lstrip().startswith("# ")
-        assert "Install" in text
-        assert "Usage" in text
-
-    def test_license_file_is_created(self, scaffolded_orders: Path):
-        license_file = scaffolded_orders.parent / "LICENSE"
-        assert license_file.exists(), "no LICENSE generated"
-        assert "MIT License" in license_file.read_text()
-
-    def test_pyproject_satisfies_check_metadata(self, scaffolded_orders: Path):
-        content = (scaffolded_orders.parent / "pyproject.toml").read_text()
-        assert 'readme = "README.md"' in content
-        assert 'license = "MIT"' in content
-        assert '"simple-module"' in content
-        assert 'Repository = "https://github.com/antosubash/simple_module_python"' in content
diff --git a/skills/simple-module-creating/SKILL.md b/skills/simple-module-creating/SKILL.md
index 4f997610c..73bd6e80b 100644
--- a/skills/simple-module-creating/SKILL.md
+++ b/skills/simple-module-creating/SKILL.md
@@ -11,7 +11,8 @@ description: Use when adding a new feature package to a simple_module_python app
 
 ```bash
 # scaffold a module into this repo's modules/orders/ — also wires the package
-# into host/ + root pyproject.toml and runs `uv sync --all-packages`
+# into host/ + root pyproject.toml + the release matrix, then runs
+# `uv sync --all-packages`, `npm install` and `make gen-i18n`
 make new-module name=orders
 
 # if you added a frontend page, regenerate the Inertia manifest
@@ -22,11 +23,15 @@ make migration msg="add orders module"
 make migrate
 ```
 
-`make new-module` (→ `scripts/new_module.py`) is the in-repo path and produces
-the full tree below. For a **standalone publishable package** (its own repo,
-with CI + PyPI `publish.yml`), use `smpy create-module orders` instead — a
-leaner scaffold; pass `--standalone` to force the `.github/` workflows, then
-`uv sync` (or `pip install -e ./orders`) to install it into the host.
+`make new-module` (→ `scripts/new_module.py`) is the in-repo path. It calls the
+same `create_module` as `smpy create-module`, so both produce the same tree
+below (permissions, menu item with `label_key`, `constants.py`, CRUD sample,
+`locales/en.json`); the in-repo variant adds workspace-sourced `pyproject.toml`
+metadata, `LICENSE`, and i18n-keyed pages. For a **standalone publishable
+package** (its own repo, with CI + PyPI `publish.yml`), use
+`smpy create-module orders`; pass `--standalone` to force the `.github/`
+workflows, then `uv sync` (or `pip install -e ./orders`) to install it into the
+host.
 
 ## What scaffolding produces
 
@@ -38,20 +43,23 @@ modules/orders/
 ├── tests/test_orders.py
 └── orders/
     ├── module.py           # OrdersModule(ModuleBase) with ModuleMeta
+    ├── constants.py        # PERM_*, PAGE_*, MENU_* — no magic strings elsewhere
     ├── models.py           # Base = create_module_base("orders")
     ├── contracts/schemas.py # SQLModel DTOs — public surface
     ├── service.py          # business logic
     ├── services.py         # app.state.orders state container (settings)
-    ├── settings.py         # SM_ORDERS_* env → dataclass
+    ├── settings.py         # DbBackedSettings subclass (DB-backed, no env)
     ├── deps.py             # FastAPI dependencies
     ├── endpoints/{api,views}.py
     ├── pages/{Browse,Create,Edit}.tsx  # *.tsx, auto-discovered by Vite
     └── locales/en.json
 ```
 
-`make new-module` also edits `host/pyproject.toml` (adds the workspace dep) and
-the root `pyproject.toml` (type-check + test paths), so the module is picked up
-by the host and by `make lint`/`make test` without further wiring.
+`make new-module` also edits `host/pyproject.toml` (adds the workspace dep), the
+root `pyproject.toml` (type-check + test paths) and the `publish-pypi` matrix in
+`release.yml`, so the module is picked up by the host and by `make lint`/`make
+test` without further wiring. Commit the `uv.lock`, `package-lock.json` and
+regenerated i18n key files it leaves behind.
 
 ## The contract: pyproject.toml + module.py
 
diff --git a/skills/simple-module-testing/SKILL.md b/skills/simple-module-testing/SKILL.md
index 6ee72cc32..50e419535 100644
--- a/skills/simple-module-testing/SKILL.md
+++ b/skills/simple-module-testing/SKILL.md
@@ -87,7 +87,7 @@ modules/orders/
     └── test_orders.py       # imports orders.service — name from the scaffold
 ```
 
-The directory must be listed in the root `pyproject.toml` under `[tool.pytest.ini_options].testpaths` for `make test` to pick it up. Both `smpy create-module` and `make new-module name=<name>` add this entry (via `scripts/new_module.py`'s `update_root_pyproject`); if you scaffolded a module by hand, add it.
+The directory must be listed in the root `pyproject.toml` under `[tool.pytest.ini_options].testpaths` for `make test` to pick it up. Both `smpy create-module` and `make new-module name=<name>` add this entry (via `simple_module_cli.framework_repo.update_root_pyproject`); if you scaffolded a module by hand, add it.
 
 ## Pitfalls
 
diff --git a/uv.lock b/uv.lock
index de9f41c75..c2ecc98f9 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3166,7 +3166,7 @@ dependencies = [
 [package.metadata]
 requires-dist = [
     { name = "babel", specifier = ">=2.14" },
-    { name = "fastapi", specifier = ">=0.115" },
+    { name = "fastapi", specifier = ">=0.140,<0.157" },
     { name = "packaging", specifier = ">=23.0" },
     { name = "pydantic", specifier = ">=2.0" },
     { name = "pydantic-settings", specifier = ">=2.0" },
@@ -3249,18 +3249,22 @@ dependencies = [
 s3 = [
     { name = "aioboto3" },
 ]
+tasks = [
+    { name = "simple-module-background-tasks" },
+]
 
 [package.metadata]
 requires-dist = [
     { name = "aioboto3", marker = "extra == 's3'", specifier = ">=13" },
     { name = "aiofiles", specifier = ">=23" },
     { name = "pillow", specifier = ">=10" },
+    { name = "simple-module-background-tasks", marker = "extra == 'tasks'", editable = "modules/background_tasks" },
     { name = "simple-module-core", editable = "framework/core" },
     { name = "simple-module-db", editable = "framework/db" },
     { name = "simple-module-hosting", editable = "framework/hosting" },
     { name = "simple-module-settings", editable = "modules/settings" },
 ]
-provides-extras = ["s3"]
+provides-extras = ["s3", "tasks"]
 
 [[package]]
 name = "simple-module-host"
@@ -3329,7 +3333,7 @@ redis = [
 [package.metadata]
 requires-dist = [
     { name = "click", specifier = ">=8.1" },
-    { name = "fastapi", specifier = ">=0.115" },
+    { name = "fastapi", specifier = ">=0.140,<0.157" },
     { name = "httpx", specifier = ">=0.27" },
     { name = "itsdangerous", specifier = ">=2.0" },
     { name = "jinja2", specifier = ">=3.1" },
@@ -3355,7 +3359,7 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "fastapi", specifier = ">=0.115" },
+    { name = "fastapi", specifier = ">=0.140,<0.157" },
     { name = "jinja2", specifier = ">=3.1" },
     { name = "starlette", specifier = ">=0.44" },
 ]
@@ -3554,7 +3558,7 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "fastapi", specifier = ">=0.115" },
+    { name = "fastapi", specifier = ">=0.140,<0.157" },
     { name = "httpx", specifier = ">=0.27" },
     { name = "pytest", specifier = ">=8.0" },
     { name = "pytest-asyncio", specifier = ">=0.24" },