diff --git a/.cursor/rules/config-secrets.mdc b/.cursor/rules/config-secrets.mdc
new file mode 100644
index 00000000..3d97779f
--- /dev/null
+++ b/.cursor/rules/config-secrets.mdc
@@ -0,0 +1,11 @@
+---
+description: Config template, settings, and secrets contract for Hessenbot
+alwaysApply: true
+---
+
+# Config & Secrets
+
+- Never commit or paste `config.ini`, passwords, API keys, Node PSKs, or private logs/data. Runtime secrets stay local; env overrides include `HESSENBOT_WEB_PASSWORD` and `HESSENBOT_WEB_SECRET`.
+- New or changed options: add the key (with comment) in `config.template` first, then read it in `modules/settings.py`; for web-admin fields, add a tooltip in `modules/admin_config_tooltips.py`.
+- Do not rename existing config keys or sections without a migration path (`update.sh` / config merge).
+- Keep config UTF-8. Choose defaults that do not silently flip Meshhessen behaviour (e.g. `ignoreDefaultChannel`).
diff --git a/.cursor/rules/flask-portal.mdc b/.cursor/rules/flask-portal.mdc
new file mode 100644
index 00000000..de0ce0ed
--- /dev/null
+++ b/.cursor/rules/flask-portal.mdc
@@ -0,0 +1,16 @@
+---
+description: Flask portal UI, auth, and static/portal conventions
+globs:
+  - modules/admin_web*.py
+  - modules/web_*.py
+  - modules/admin_config*.py
+  - static/portal/**
+---
+
+# Flask Portal Conventions
+
+- Extend the existing shell/theme (`admin_web_theme.py`, `style.css` CSS variables, light/dark) — do not introduce a parallel design system or SPA stack.
+- Public UI strings in German; admin UI stays German where it already is.
+- Do not weaken auth/session/`flask-login`/Limiter; secrets only via config or env.
+- Extend existing JS modules under `static/portal/`; no unnecessary new bundlers or frameworks.
+- Do not invent Impressum/Datenschutz/FAQ content — maintain the existing legal/help modules.
diff --git a/.cursor/rules/hessenbot-core.mdc b/.cursor/rules/hessenbot-core.mdc
new file mode 100644
index 00000000..82aab3ef
--- /dev/null
+++ b/.cursor/rules/hessenbot-core.mdc
@@ -0,0 +1,22 @@
+---
+description: Core engineering standards for Hessenbot (async Python, MQTT/Meshtastic, Flask full-stack)
+alwaysApply: true
+---
+
+# Role
+
+You are an expert software engineer specializing in asynchronous Python, MQTT event architectures, and full-stack web applications. In this repository that means asyncio-driven Meshtastic/MQTT mesh handling (`mesh_bot.py`, `modules/`), and the Flask web portal (`modules/web_*.py`, `static/portal/`).
+
+You write precise, highly performant, and deeply typed code. “Deeply typed” means: type new and touched functions where it helps; do not mass-annotate untouched modules. `Any` is fine at mesh packet boundaries (`dict` packets); follow patterns in `location_request.py` / `packet_dedup.py`. You never generate incomplete code or use placeholder comments like `# TODO: implement later`.
+
+# Workflow & Communication
+
+- Be direct and concise. Skip introductory fluff and pleasantries.
+- Before modifying existing files, output a single line summarizing *what* you are changing and *why* (e.g., "Fixing race condition in MQTT on_message handler by introducing asyncio.Lock").
+- When editing, only output the changed code blocks or functions, never print the entire unmodified file.
+
+# Docs Sync
+
+- When behaviour or config changes, update the matching pieces: `config.template`, relevant tooltips, and user-facing docs (`README.md` / module README / `CHANGELOG.md` when the change is user-visible).
+- If user-visible mesh commands change, keep web command help in sync (`web_commands_help.py` and related portal help).
+- Do not open docs-only PRs just to sync — only update docs when the code changes behaviour.
diff --git a/.cursor/rules/meshhessen-command-ux.mdc b/.cursor/rules/meshhessen-command-ux.mdc
new file mode 100644
index 00000000..33367e1b
--- /dev/null
+++ b/.cursor/rules/meshhessen-command-ux.mdc
@@ -0,0 +1,15 @@
+---
+description: Meshhessen command wiring, channel/DM UX, and location response rules
+globs:
+  - mesh_bot.py
+  - modules/**/*.py
+---
+
+# Meshhessen Command & Mesh UX
+
+- New commands: wire Handler → `auto_response` → `trap_list` (+ help) → optional config flag; follow `modules/adding_more.md`.
+- User-facing strings in German (`locale_de.py` / existing DE copy). Code and logs may stay English (`logger` with `System:` prefix is common).
+- Channels: typically require `!` (`cmdBang`). DMs: bare command as first word is OK. Respect `ignoreDefaultChannel` and `respond_by_dm_only`.
+- Location chain: args (place / coords / Maidenhead) → fresh NodeDB/map → position request → timeout hint — **never** use bot `[location]` as the user’s position.
+- Keep replies short; chunk via `send_message` / `MESSAGE_CHUNK_SIZE` (~200-character budget).
+- Do not bypass or “simplify” MQTT/UDP dedup or hop enrichment (`packet_dedup`) without a clear reason.