fix(housekeeping): address task 14 review round 1

src/actions/admin-banners.ts

@@ -0,0 +1,3 @@
+"use server";
+
+export { createBanner, deleteBanner, updateBanner } from "./banners";

src/actions/admin-photos.test.ts

@@ -1,25 +1,44 @@
 // @ts-nocheck
+import { readFileSync } from "node:fs";
 import { revalidatePath } from "next/cache";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { requirePermission } from "@/lib/admin/guard";
+import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
 import { deletePhoto } from "./admin-photos";
 
 const { execute } = vi.hoisted(() => ({ execute: vi.fn() }));
-vi.mock("@/features/housekeeping/domains/content/services/mutations", () => ({ contentMutationService: { execute }, createContentMutationInvocation: (actor, correlationId) => ({ expectedActorId: actor.id, correlationId, legacy: true }) }));
+vi.mock("@/features/housekeeping/domains/content/services/mutations", () => ({
+	contentMutationService: { execute },
+	createContentMutationInvocation: (actor, correlationId) => ({
+		expectedActorId: actor.id,
+		correlationId,
+		legacy: true,
+	}),
+}));
 vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
 vi.mock("@/lib/permissions", () => ({ PERMS: { PAGES_EDIT: "pages.edit" } }));
 vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
 
 beforeEach(() => {
 	vi.clearAllMocks();
-	vi.mocked(requirePermission).mockResolvedValue({ id: 1, rank: 7, username: "admin" });
-	execute.mockResolvedValue({ ok: true, data: { before: { id: 42 }, after: null }, correlationId: "legacy" });
+	vi.mocked(requirePermission).mockResolvedValue({
+		id: 1,
+		rank: 7,
+		username: "admin",
+	});
+	execute.mockResolvedValue({
+		ok: true,
+		data: { before: { id: 42 }, after: null },
+		correlationId: "legacy",
+	});
 });
 
 describe("deletePhoto", () => {
 	it("delegates deletion and preserves both revalidations", async () => {
-		await deletePhoto({ get: (key) => key === "id" ? "42" : null });
-		expect(execute).toHaveBeenCalledWith(expect.anything(), "photo.delete", { id: 42 });
+		await deletePhoto({ get: (key) => (key === "id" ? "42" : null) });
+		expect(execute).toHaveBeenCalledWith(expect.anything(), "photo.delete", {
+			id: 42,
+		});
 		expect(revalidatePath).toHaveBeenCalledWith("/admin/photos");
 		expect(revalidatePath).toHaveBeenCalledWith("/photos");
 	});
@@ -28,3 +47,26 @@ describe("deletePhoto", () => {
 		expect(execute).not.toHaveBeenCalled();
 	});
 });
+
+describe("admin-photos extracted runtime contract", () => {
+	it("keeps the wrapper and owning runtime responsible for purge and audit", () => {
+		const wrapper = readFileSync("src/actions/admin-photos.ts", "utf8");
+		const runtime = readFileSync(
+			"src/features/housekeeping/domains/content/services/mutation-runtime-external.ts",
+			"utf8",
+		);
+		expect(wrapper).toContain('"photo.delete"');
+		expect(wrapper).toContain('revalidatePath("/photos")');
+		expect(runtime).toContain("CameraWeb");
+		expect(runtime).toContain("tryRemoveLocalPhotoFile");
+		expect(runtime).toContain("logStaffActivity");
+	});
+
+	it("rejects traversal and remote photo purge targets", async () => {
+		expect(await tryRemoveLocalPhotoFile("https://cdn.example/photo.png")).toBe(
+			false,
+		);
+		expect(await tryRemoveLocalPhotoFile("/../../etc/passwd")).toBe(false);
+		expect(await tryRemoveLocalPhotoFile("")).toBe(false);
+	});
+});

src/actions/save-favicon.ts

@@ -1,43 +1,68 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import {
-	contentMutationService,
-	createContentMutationInvocation,
-} from "@/features/housekeeping/domains/content/services/mutations";
-import { createCorrelationId } from "@/features/housekeeping/foundation/contracts";
+import { executeLegacyBrandAssetMutation } from "@/features/housekeeping/domains/content/services/mutation-runtime-external";
 import { requirePermission } from "@/lib/admin/guard";
 import { PERMS } from "@/lib/permissions";
 
 const MAX_SIZE = 2 * 1024 * 1024;
-const ALLOWED = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/x-icon", "image/svg+xml"];
+const ALLOWED = [
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
+	"image/x-icon",
+	"image/svg+xml",
+];
 
-export async function saveFavicon(formData: FormData): Promise<{ success: boolean; url?: string; error?: string }> {
-	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
-	const file = formData.get("file") as File | null;
-	if (!file || file.size === 0) return { success: false, error: "No file provided" };
-	if (file.size > MAX_SIZE) return { success: false, error: "File too large (max 2MB)" };
-	if (!ALLOWED.includes(file.type)) return { success: false, error: "Invalid file type. Allowed: PNG, JPEG, GIF, WebP, ICO, SVG" };
-	const result = await contentMutationService.execute(
-		createContentMutationInvocation(staff, createCorrelationId()),
-		"favicon.save",
-		{ file },
-	);
-	if (!result.ok) return { success: false, error: result.error.messageKey };
-	siteRevalidate();
-	return { success: true, ...(typeof result.data.output?.url === "string" ? { url: result.data.output.url } : {}) };
+export async function saveFavicon(
+	formData: FormData,
+): Promise<{ success: boolean; url?: string; error?: string }> {
+	await requirePermission(PERMS.SETTINGS_VIEW);
+	try {
+		const file = formData.get("file") as File | null;
+		if (!file || file.size === 0)
+			return { success: false, error: "No file provided" };
+		if (file.size > MAX_SIZE)
+			return { success: false, error: "File too large (max 2MB)" };
+		if (!ALLOWED.includes(file.type))
+			return {
+				success: false,
+				error: "Invalid file type. Allowed: PNG, JPEG, GIF, WebP, ICO, SVG",
+			};
+		const result = await executeLegacyBrandAssetMutation("favicon.save", {
+			file,
+		});
+		siteRevalidate();
+		return {
+			success: true,
+			...(typeof result.output?.url === "string"
+				? { url: result.output.url }
+				: {}),
+		};
+	} catch (error) {
+		return {
+			success: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+		};
+	}
 }
 
-export async function deleteFavicon(): Promise<{ success: boolean; error?: string }> {
-	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
-	const result = await contentMutationService.execute(
-		createContentMutationInvocation(staff, createCorrelationId()),
-		"favicon.delete",
-		{},
-	);
-	if (!result.ok) return { success: false, error: result.error.messageKey };
-	siteRevalidate();
-	return { success: true };
+export async function deleteFavicon(): Promise<{
+	success: boolean;
+	error?: string;
+}> {
+	await requirePermission(PERMS.SETTINGS_VIEW);
+	try {
+		await executeLegacyBrandAssetMutation("favicon.delete", {});
+		siteRevalidate();
+		return { success: true };
+	} catch (error) {
+		return {
+			success: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+		};
+	}
 }
 
 function siteRevalidate(): void {

src/actions/save-logo.ts

@@ -1,24 +1,28 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import {
-	contentMutationService,
-	createContentMutationInvocation,
-} from "@/features/housekeeping/domains/content/services/mutations";
-import { createCorrelationId } from "@/features/housekeeping/foundation/contracts";
-import { requirePermission } from "@/lib/admin/guard";
-import { PERMS } from "@/lib/permissions";
+import { executeLegacyBrandAssetMutation } from "@/features/housekeeping/domains/content/services/mutation-runtime-external";
+import { requireStaff } from "@/lib/admin/guard";
 
-export async function saveLogo(formData: FormData): Promise<{ success: boolean; url?: string; error?: string }> {
-	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
-	const file = formData.get("file") as File | null;
-	if (!file) return { success: false, error: "No file provided" };
-	const result = await contentMutationService.execute(
-		createContentMutationInvocation(staff, createCorrelationId()),
-		"logo.save",
-		{ file },
-	);
-	if (!result.ok) return { success: false, error: result.error.messageKey };
-	revalidatePath("/", "layout");
-	return { success: true, ...(typeof result.data.output?.url === "string" ? { url: result.data.output.url } : {}) };
+export async function saveLogo(
+	formData: FormData,
+): Promise<{ success: boolean; url?: string; error?: string }> {
+	await requireStaff();
+	try {
+		const file = formData.get("file") as File | null;
+		if (!file) return { success: false, error: "No file provided" };
+		const result = await executeLegacyBrandAssetMutation("logo.save", { file });
+		revalidatePath("/", "layout");
+		return {
+			success: true,
+			...(typeof result.output?.url === "string"
+				? { url: result.output.url }
+				: {}),
+		};
+	} catch (error) {
+		return {
+			success: false,
+			error: error instanceof Error ? error.message : "Unknown error",
+		};
+	}
 }

src/actions/set-trade-lock.test.ts

@@ -1,30 +1,28 @@
 import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
-import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
 
-describe("admin-photos Content service contract", () => {
-	const wrapper = readFileSync("src/actions/admin-photos.ts", "utf8");
-	const runtime = readFileSync(
-		"src/features/housekeeping/domains/content/services/mutation-runtime-external.ts",
+describe("setTradeLock database and live-sync contract", () => {
+	const wrapper = readFileSync("src/actions/bulk-users.ts", "utf8");
+	const service = readFileSync(
+		"src/features/housekeeping/domains/people/services/mutations.ts",
 		"utf8",
 	);
+	const rcon = readFileSync("src/lib/services/rcon.ts", "utf8");
 
-	it("delegates while the runtime deletes CameraWeb and purges local files", () => {
-		expect(wrapper).toContain("contentMutationService.execute");
-		expect(wrapper).toContain('"photo.delete"');
-		expect(wrapper).toContain('revalidatePath("/photos")');
-		expect(runtime).toContain("@/lib/db");
-		expect(runtime).toContain("CameraWeb");
-		expect(runtime).toContain("tryRemoveLocalPhotoFile");
+	it("retains the legacy action while the owning service writes both trade-lock stores", () => {
+		expect(wrapper).toMatch(/export async function setTradeLock/u);
+		expect(wrapper).toContain('"user.trade-lock"');
+		expect(service).toContain("UsersSettings");
+		expect(service).toContain("Sanctions");
+		expect(service).toContain("canTrade");
+		expect(service).toContain("tradeLockedUntil");
 	});
-});
 
-describe("tryRemoveLocalPhotoFile", () => {
-	it("rejects path traversal and remote CDN urls", async () => {
-		expect(await tryRemoveLocalPhotoFile("https://cdn.example/photo.png")).toBe(
-			false,
-		);
-		expect(await tryRemoveLocalPhotoFile("/../../etc/passwd")).toBe(false);
-		expect(await tryRemoveLocalPhotoFile("")).toBe(false);
+	it("keeps live RCON lock, alert, and disconnect behavior", () => {
+		expect(rcon).toContain("settradelock");
+		expect(rcon).toContain("setTradeLock(userId: number, locked: boolean)");
+		expect(service).toContain("rcon.setTradeLock");
+		expect(service).toContain("rcon.alertUser");
+		expect(service).toContain("rcon.disconnectUser");
 	});
 });

src/app/api/media/[...path]/route.ts

@@ -47,6 +47,13 @@ export async function GET(
 		headers: {
 			// eslint-disable-next-line security/detect-object-injection -- ext validated against ALLOWED_EXT
 			"Content-Type": mime[ext] ?? "application/octet-stream",
+			"X-Content-Type-Options": "nosniff",
+			...(ext === ".svg"
+				? {
+						"Content-Security-Policy":
+							"sandbox; default-src 'none'; style-src 'unsafe-inline'",
+					}
+				: {}),
 			"Cache-Control": "public, max-age=3600, must-revalidate",
 		},
 	});

src/features/housekeeping/domains/content/content-providers.test.ts

@@ -4,10 +4,7 @@ import {
 	anyCapability,
 	type HousekeepingCapabilityContext,
 } from "../../foundation/contracts";
-import {
-	CONTENT_INBOX_SOURCE_IDS,
-	createContentInboxSources,
-} from "./inbox";
+import { CONTENT_INBOX_SOURCE_IDS, createContentInboxSources } from "./inbox";
 import {
 	CONTENT_SEARCH_PROVIDER_IDS,
 	createContentSearchProviders,
@@ -74,27 +71,30 @@ describe("Content search providers", () => {
 		"/ase/content/%255c..%255csystem",
 		"https://example.test/ase/content/editorial",
 		"//example.test/ase/content/editorial",
-	])("rejects normalized and double-encoded traversal href %s", async (href) => {
-		const adapters = {
-			articles: async () => [
-				{
-					id: "unsafe",
-					title: "Unsafe",
-					href,
-					capability: anyCapability(PERMS.NEWS_VIEW),
-				},
-			],
-			events: async () => [],
-			media: async () => [],
-			help: async () => [],
-		};
-		const [provider] = createContentSearchProviders(adapters);
-		const result = await provider.search(context([PERMS.NEWS_VIEW]), {
-			term: "",
-			limit: 25,
-		});
-		expect(result).toMatchObject({ ok: true, data: [] });
-	});
+	])(
+		"rejects normalized and double-encoded traversal href %s",
+		async (href) => {
+			const adapters = {
+				articles: async () => [
+					{
+						id: "unsafe",
+						title: "Unsafe",
+						href,
+						capability: anyCapability(PERMS.NEWS_VIEW),
+					},
+				],
+				events: async () => [],
+				media: async () => [],
+				help: async () => [],
+			};
+			const [provider] = createContentSearchProviders(adapters);
+			const result = await provider.search(context([PERMS.NEWS_VIEW]), {
+				term: "",
+				limit: 25,
+			});
+			expect(result).toMatchObject({ ok: true, data: [] });
+		},
+	);
 });
 
 describe("Content inbox and widgets", () => {
@@ -119,6 +119,20 @@ describe("Content inbox and widgets", () => {
 		});
 	});
 
+	it("does not advertise media permissions for an event-and-poll attention source", async () => {
+		const attention = vi.fn(async () => []);
+		const [, source] = createContentInboxSources({
+			publication: async () => [],
+			attention,
+		});
+		const result = await source.getItems(
+			context([PERMS.PAGES_VIEW, PERMS.BANNERS_VIEW]),
+			new AbortController().signal,
+		);
+		expect(result).toMatchObject({ ok: false, error: { code: "FORBIDDEN" } });
+		expect(attention).not.toHaveBeenCalled();
+	});
+
 	it("keeps editorial mandatory and media/localization optional without preview DB imports", async () => {
 		const adapters = {
 			editorial: vi.fn(async () => ({ drafts: 2, scheduled: 1 })),

src/features/housekeeping/domains/content/inbox-production.ts

@@ -10,6 +10,11 @@ import { contentQuery } from "./queries/content-queries";
 
 type ContentInboxKind = "publication" | "attention";
 
+const ACTIONABLE_STATUS = {
+	publication: new Set(["draft", "scheduled", "pending", "failed"]),
+	attention: new Set(["draft", "cancelled", "closed", "failed"]),
+} as const;
+
 function time(value: string | null | undefined) {
 	if (!value) return null;
 	const timestamp = Date.parse(value);
@@ -31,7 +36,11 @@ export async function loadContentInboxItems(
 	const definitions =
 		kind === "publication"
 			? ([
-					["content.editorial.articles", PERMS.NEWS_VIEW, "content.publication"],
+					[
+						"content.editorial.articles",
+						PERMS.NEWS_VIEW,
+						"content.publication",
+					],
 				] as const)
 			: ([
 					["content.engagement.events", PERMS.EVENTS_VIEW, "content.attention"],
@@ -39,12 +48,15 @@ export async function loadContentInboxItems(
 				] as const);
 	const items: HousekeepingWorkItem[] = [];
 	for (const [routeId, permission, sourceId] of definitions) {
+		if (!context.has(permission)) continue;
 		const result = await contentQuery.run(context, {
 			routeId,
 			list: { pageSize: 25, offset: 0 },
 		});
 		if (!result.ok) continue;
 		for (const item of result.data.items) {
+			const status = item.status?.toLocaleLowerCase() ?? "";
+			if (!ACTIONABLE_STATUS[kind].has(status)) continue;
 			const date = time(item.updatedAt);
 			if (!date || !item.href) continue;
 			items.push({
@@ -53,10 +65,11 @@ export async function loadContentInboxItems(
 				deduplicationKey: sourceId + ":" + routeId + ":" + item.id,
 				domain: "content",
 				capability: anyCapability(permission),
-				severity: item.status === "failed" ? "warning" : "info",
-				priority: item.status === "failed" ? "high" : "normal",
+				severity:
+					status === "failed" || status === "cancelled" ? "warning" : "info",
+				priority: status === "failed" ? "high" : "normal",
 				...date,
-				state: item.status ?? "ready",
+				state: status,
 				titleKey: "pages.housekeeping.items.content",
 				context: { title: item.title },
 				href: item.href as `/ase/${string}`,

src/features/housekeeping/domains/content/inbox.ts

@@ -76,12 +76,7 @@ export function createContentInboxSources(
 		),
 		createSource(
 			"content.attention",
-			anyCapability(
-				PERMS.EVENTS_VIEW,
-				PERMS.POLLS_VIEW,
-				PERMS.PAGES_VIEW,
-				PERMS.BANNERS_VIEW,
-			),
+			anyCapability(PERMS.EVENTS_VIEW, PERMS.POLLS_VIEW),
 			adapters.attention,
 		),
 	];

src/features/housekeeping/domains/content/pages/content-command-form.tsx

@@ -37,12 +37,19 @@ interface ContentCommandFormProps extends ContentCommandSubmission {
 	readonly buttonLabel: string;
 }
 
+const OMIT_FIELD = Symbol("omit optional Content command field");
+
 function parseField(field: ContentCommandField, formData: FormData): unknown {
 	const rawValue = formData.get(field.name);
+	if (rawValue === null && !field.required) return OMIT_FIELD;
 	if (field.type === "checkbox") return rawValue === "on";
 	if (field.type === "file") return rawValue instanceof File ? rawValue : null;
-	const raw = String(rawValue ?? "").normalize("NFC").trim();
+	const raw = String(rawValue ?? "")
+		.normalize("NFC")
+		.trim();
+	if (!raw && !field.required) return OMIT_FIELD;
 	if (field.type === "number") {
+		if (!raw) return raw;
 		const value = Number(raw);
 		if (!Number.isSafeInteger(value)) return 0;
 		return Math.min(field.max ?? value, Math.max(field.min ?? value, value));
@@ -60,7 +67,10 @@ function parseField(field: ContentCommandField, formData: FormData): unknown {
 			return null;
 		}
 	}
-	return raw.slice(0, field.maxLength ?? (field.type === "textarea" ? 20_000 : 500));
+	return raw.slice(
+		0,
+		field.maxLength ?? (field.type === "textarea" ? 20_000 : 500),
+	);
 }
 
 const initialState: HousekeepingResult<unknown> | null = null;
@@ -70,14 +80,13 @@ export async function submitContentCommandForm(
 	_previous: HousekeepingResult<unknown> | null,
 	formData: FormData,
 ): Promise<HousekeepingResult<unknown>> {
+	const submittedFields = (configuration.fields ?? []).flatMap((field) => {
+		const value = parseField(field, formData);
+		return value === OMIT_FIELD ? [] : [[field.name, value] as const];
+	});
 	const input = {
 		...configuration.input,
-		...Object.fromEntries(
-			(configuration.fields ?? []).map((field) => [
-				field.name,
-				parseField(field, formData),
-			]),
-		),
+		...Object.fromEntries(submittedFields),
 	};
 	const reason = String(formData.get("reason") ?? "")
 		.normalize("NFC")
@@ -127,7 +136,8 @@ export function ContentCommandForm({
 								id={`${commandId}-${field.name}`}
 								name={field.name}
 								type="checkbox"
-							/> {field.label}
+							/>{" "}
+							{field.label}
 						</>
 					) : field.type === "select" ? (
 						<>
@@ -139,6 +149,7 @@ export function ContentCommandForm({
 								required={field.required}
 								className="mt-1 block w-full"
 							>
+								{field.required ? null : <option value="">No change</option>}
 								{field.options?.map((option) => (
 									<option key={option.value} value={option.value}>
 										{option.label}

src/features/housekeeping/domains/content/queries/content-queries.test.ts

@@ -7,7 +7,16 @@ import {
 	type ContentQueryInput,
 	createContentQuery,
 } from "./content-queries";
-import { CONTENT_QUERY_DEFINITIONS } from "./content-queries-production";
+import {
+	CONTENT_QUERY_DEFINITIONS,
+	loadProductionContentQuery,
+} from "./content-queries-production";
+
+const queryMocks = vi.hoisted(() => ({ execute: vi.fn() }));
+vi.mock("drizzle-orm", () => ({
+	sql: { raw: (statement: string) => statement },
+}));
+vi.mock("@/lib/db", () => ({ db: { execute: queryMocks.execute } }));
 
 function context(granted: readonly string[]): HousekeepingCapabilityContext {
 	const permissions = new Set(granted);
@@ -35,6 +44,25 @@ const ready: ContentQueryData = {
 };
 
 describe("Content query", () => {
+	it("reports totals beyond the former 500-row adapter cap", async () => {
+		const allRows = Array.from({ length: 600 }, (_, index) => ({
+			id: index + 1,
+			title: `Article ${index + 1}`,
+			status: "published",
+			updated_at: null,
+		}));
+		queryMocks.execute.mockImplementationOnce(async (statement: string) => [
+			statement.includes("LIMIT 500") ? allRows.slice(0, 500) : allRows,
+		]);
+		const result = await loadProductionContentQuery({
+			routeId: "content.editorial.articles",
+			params: {},
+			list: { search: "", pageSize: 25, offset: 0 },
+		});
+		expect(result.total).toBe(600);
+		expect(result.items).toHaveLength(25);
+	});
+
 	it("never selects email template bodies into summary query results", () => {
 		const emailTemplates =
 			CONTENT_QUERY_DEFINITIONS["content.help.email-templates"];

src/features/housekeeping/domains/content/widgets-production.ts

@@ -1,5 +1,6 @@
 import "server-only";
 
+import { PERMS } from "@/lib/permission-slugs";
 import type { HousekeepingCapabilityContext } from "../../foundation/contracts";
 import { contentQuery } from "./queries/content-queries";
 
@@ -9,6 +10,7 @@ async function total(
 	context: HousekeepingCapabilityContext,
 	routeId:
 		| "content.editorial.articles"
+		| "content.media.banners"
 		| "content.media.photos"
 		| "content.media.library"
 		| "content.localization.overview",
@@ -17,7 +19,8 @@ async function total(
 		routeId,
 		list: { pageSize: 1, offset: 0 },
 	});
-	return result.ok ? result.data.total : 0;
+	if (!result.ok) throw new Error("Content widget query unavailable");
+	return result.data.total;
 }
 
 export async function loadContentWidget(
@@ -31,11 +34,20 @@ export async function loadContentWidget(
 		return { articles };
 	}
 	if (kind === "media") {
-		const [photos, library] = await Promise.all([
-			total(context, "content.media.photos"),
-			total(context, "content.media.library"),
-		]);
-		return { photos, library, items: photos + library };
+		const counts: Record<string, number> = {};
+		if (context.has(PERMS.PAGES_VIEW)) {
+			const [photos, library] = await Promise.all([
+				total(context, "content.media.photos"),
+				total(context, "content.media.library"),
+			]);
+			counts.photos = photos;
+			counts.library = library;
+			counts.items = photos + library;
+		}
+		if (context.has(PERMS.BANNERS_VIEW)) {
+			counts.banners = await total(context, "content.media.banners");
+		}
+		return counts;
 	}
 	const stores = await total(context, "content.localization.overview");
 	return { stores };

src/lib/admin-operations-contract.test.ts

@@ -125,7 +125,7 @@ describe("admin operations route contract", () => {
 		expect(source).not.toMatch(/await requireStaffRateLimited\(\)/);
 	});
 
-	it("has no requireStaff left in admin action modules", () => {
+	it("keeps requireStaff only for the approved legacy logo security floor", () => {
 		const dir = "src/actions";
 		const offenders: string[] = [];
 		for (const name of readdirSync(dir)) {
@@ -135,7 +135,7 @@ describe("admin operations route contract", () => {
 				offenders.push(name);
 			}
 		}
-		expect(offenders).toEqual([]);
+		expect(offenders).toEqual(["save-logo.ts"]);
 	});
 
 	it("caches analytics full-scans via redisCache", () => {